'%3e%3c/ellipse%3e%3cpath%20d='M20.5%2023.5%20L3.4%2045.6%20L23%2031.8%20Z'%20fill='%23B4EE3A'%20stroke='%23B4EE3A'%20stroke-width='3'%20stroke-linejoin='round'%20stroke-linecap='round'%3e%3c/path%3e%3cpath%20d='M47%2020.5%20Q42%2033%2030.5%2036.5'%20stroke='%23FFFFFF'%20stroke-opacity='0.35'%20stroke-width='2.4'%20fill='none'%20stroke-linecap='round'%3e%3c/path%3e%3ccircle%20cx='30.2'%20cy='20.2'%20r='4.4'%20fill='%23FFFFFF'%3e%3c/circle%3e%3ccircle%20cx='28.9'%20cy='20.4'%20r='2.15'%20fill='%23101116'%3e%3c/circle%3e%3ccircle%20cx='27.9'%20cy='19.1'%20r='0.85'%20fill='%23FFFFFF'%3e%3c/circle%3e%3c/svg%3e)
Active sub-processors
These companies process customer personal data on Hackiwi's behalf, under written contracts imposing the obligations required by Article 28(4) GDPR.
| Sub-processor | Country | Purpose | Data shared | DPA |
|---|---|---|---|---|
| Cloudflare, Inc. | USA (EU Standard Contractual Clauses) | Infrastructure, database, CDN, WAF | All platform data | cloudflare.com/gdpr |
| Resend, Inc. | USA (EU Standard Contractual Clauses) | Transactional email | Email addresses, message content | resend.com/legal/dpa |
| Functional Software, Inc. (Sentry) | USA (EU Standard Contractual Clauses) | Error tracking | Error reports - personal data stripped before transmission | sentry.io/legal/dpa |
Clause 1.1. Each is established in the United States, and every transfer is covered by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
Clause 1.2. Cloudflare EU data localisation is available on request. Contact [email protected] before onboarding if you have a data residency requirement.
Clause 1.3. Error reports sent to Sentry have personal data stripped before transmission.
Customer-controlled integrations
not sub-processors
When customers connect their own API keys they establish a direct data processing relationship with these providers. Where no key is connected, no data is sent.
| Provider | Purpose | What is sent |
|---|---|---|
| Anthropic PBC | AI-assisted content generation | The prompts an administrator writes |
| Have I Been Pwned | Breach-exposure lookups | The domain or email address being checked |
| VirusTotal (Google) | URL and file reputation lookups | The web addresses being checked |
Clause 2.1. These are optional features. A customer that connects no keys uses the platform without any of them, and nothing reaches these providers.
Clause 2.2. Because the relationship is direct, the applicable terms are those the customer accepts with each provider. Hackiwi is not that provider's controller or processor, and does not hold a DPA with them on the customer's behalf.
Outbound services that receive no personal data
Published for completeness, because security questionnaires ask about every outbound connection. The platform queries these services for public threat and vulnerability information. None of them receives customer personal data.
| Service | Purpose |
|---|---|
| api.osv.dev (Google) | Vulnerability lookups for dependency tracking |
| crt.sh, api.certspotter.com | Public certificate transparency logs, for finding subdomains |
| rdap.org | Domain registration lookups |
| cloudflare-dns.com | DNS lookups for domain and email authentication checks |
| www.cisa.gov | The US known-exploited-vulnerabilities catalogue |
| www.ncsc.gov.uk | UK National Cyber Security Centre advisory feed |
| api.github.com | The repository star count shown on the public marketing pages |
Clause 3.1. These queries concern domains, packages and public advisories - not people.
Notification of changes
Clause 4.1. We give 30 days' notice before adding or removing a sub-processor.
Clause 4.2. Notice is sent by email to the administrative contact on each account and published here. Keep your admin email current in Settings to receive notifications.
Clause 4.3. Customers may object to a new sub-processor on reasonable data protection grounds within that period. The objection procedure, and the right to terminate without penalty if no resolution is reached, are set out in section 7 of the Data Processing Agreement.
Clause 4.4. This page is the authoritative list. Annex III of the DPA reproduces it, and both are generated from the same source, so they cannot disagree.
Contact
Requests about this list
- Sub-processor objections, DPA countersignature, transfer documentation - [email protected]
- Data residency and commercial questions - [email protected]
Last updated: September 2026.
- Legal entity
- Hackiwi B.V.
This document was prepared in good faith. Hackiwi recommends that customers seek independent legal advice regarding their own compliance obligations.