Subprocessors
Last updated: July 9, 2026
This page lists the subprocessors Candor Host uses to deliver its hosting service. Under the GDPR, subprocessors are third parties that process personal data on our behalf. Each is bound by a written contract with data protection obligations no less protective than those in our Data Processing Agreement.
We update this list when subprocessors are added or removed. Material changes are communicated to customers by email or through the client portal at least 30 days in advance.
Current subprocessors
| Subprocessor | Purpose | Location | Data types |
|---|---|---|---|
| Stripe, Inc. | Payment processing for subscription billing. | United States (Stripe operates globally with EU/UK subsidiaries). | Customer name, billing address, email, payment card details, transaction records. |
| Cloudflare, Inc. | DDoS mitigation, DNS caching, and edge CDN, at customer's option. | Global anycast network with data centers in multiple regions. | IP addresses, HTTP request metadata. |
| Contabo GmbH | Backup storage (off-site copies). | Germany. | Encrypted backup archives of hosted content. |
| Amazon Web Services, Inc. | Cold-storage backups and transactional email relay when explicitly configured by customer. | United States (US East region). | Encrypted backup archives; email metadata for outbound transactional email. |
Our website analytics run on our own infrastructure (self-hosted GoAccess and Umami) and are not operated by any subprocessor. See our Analytics Transparency page for details on what we collect from visitors to candorhost.com.
Data center and network operator
Our primary infrastructure is operated by us on hardware we own or lease directly. Our upstream network provider provides connectivity and physical facility services but does not process customer data.
| Facility | Location | Role |
|---|---|---|
| Vint Hill, Virginia colocation | Vint Hill, VA, United States. | Physical facility, power, network connectivity for web1. No access to customer data. |
Objection process
Under Section 6 of our Data Processing Agreement, customers may object to a new subprocessor within 30 days of notification. If we cannot accommodate the objection, the customer may terminate the affected service and receive a pro-rata refund.
Send objections to legal@candorhost.com.
What each subprocessor can and can't do
Every subprocessor is contractually restricted to processing customer data solely for the purpose of providing services to Candor Host. No subprocessor is permitted to:
- Sell or share customer data with third parties.
- Use customer data for advertising or profiling.
- Transfer customer data to jurisdictions without adequate data protection safeguards.
- Retain customer data beyond the period necessary to provide services.
We conduct written data protection due diligence on subprocessors before onboarding them and periodically review their compliance.
International transfers
Subprocessors located outside the European Economic Area, United Kingdom, or Switzerland are engaged under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or an equivalent transfer mechanism.
Historical subprocessors
We maintain a record of subprocessors previously used but no longer engaged. This list is available on request under the audit provisions of our DPA.
Contact
Questions about our subprocessor list or objections to a specific subprocessor: legal@candorhost.com.