Subprocessors
Last updated: 24 October 2026.
This page lists the third parties that process personal data for WebAPI Group. A provider's headquarters are not a promise about every processing location. The notes below say what each provider receives.
Customer API content is processed only in the EU/EEA, on Hetzner infrastructure in Germany (Falkenstein and Nuremberg) and Finland (Helsinki), and in our own datacenters in Toulouse. This applies to every customer and every plan.
Our datacenters in Toulouse are operated by WEBAPI GROUP SAS. They are a processing location, not a third-party subprocessor.
The public websites use Cloudflare, Inc. for DNS, delivery, and security. Cloudflare's proxy is enabled on all of these sites, and Orange-to-Orange is enabled.
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure for the service | Germany (Falkenstein, Nuremberg) and Finland (Helsinki) | Customer API content, account data stored by the service, and security logs. |
| Cloudflare, Inc. | DNS, delivery, and security for the public websites | Global | Cloudflare's proxy is enabled on all of these sites, and Orange-to-Orange is enabled. |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payments | United States and EEA | Billing details and payment-card data. Card numbers stay at Stripe. Stripe may act as an independent controller for fraud and its own legal duties. No API request bodies. |
| Postmark (ActiveCampaign, LLC) | Transactional email | United States | Recipient addresses and the content of service email. No API request bodies. |
| Google LLC | Website analytics | Global | Consented website measurement. No API request bodies. |
| Discord Inc. | Support notifications and internal discussion | United States | Messages a person sends to Discord, and limited account notices. No API request stream. |
| Slack Technologies, LLC | Internal communication | United States | Messages staff put in Slack. No API request stream. |
| Linear Orbit, Inc. | Issue tracking | United States | Issue text staff put in Linear. No API request stream. |
| GitHub, Inc. | Source code | United States | Code and engineering discussion. No customer API content. |
| Mistral AI | Support tickets, the documentation assistant, and dashboard security profiles | France | Ticket text, assistant messages, and a limited security profile. Does not receive the API request stream. |
| HubSpot, Inc. | Contact forms that embed HubSpot | United States and EEA | Name, email address, and the message submitted on those forms. No API request bodies. |
Changes
We will give at least 30 days' notice before a new subprocessor processes customer API content, by updating this page and by email to the account address. You may object during that period, as described in the data processing agreement.
Each provider is bound by a contract that requires it to protect personal data. Where a provider processes personal data outside the EEA, the transfer terms are the 2021 Standard Contractual Clauses, described in the SCC addendum.
Write to the registered office, or use the contact address published on the product website you use. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Publication director: Josselin Liebe.