Sub-Processors. The service providers that help us run Vestra.

Who receives personal data, what for, and what they receive.
Last Updated: October 10, 2026.

Privacy Policy Data Processing Addendum

Our Sub-Processors

Each provider only receives the personal data it needs for the purpose listed.

List

Current Sub-Processors

Vestra sub-processors, their purpose and the personal data they receive
Provider Purpose Personal data involved
Stripe Payment processing and subscription billing. Name, email address, billing address, payment method details, transaction history, fraud-prevention signals, and IP address and device information at checkout.
Cloudflare Content delivery (CDN), DDoS and security protection for our websites and services, and Turnstile bot checks (for example, during Discord verification). IP address, request details (such as the page requested, headers and browser information), approximate location derived from IP address, and browser and device signals used for bot detection.
Google Google Analytics on the Vestra Hosting One and Vestra Drive landing pages, only after you consent. Google Fonts delivery (fonts.googleapis.com and fonts.gstatic.com) on our websites. Google Analytics: IP address, device and browser information, pages viewed and analytics cookie identifiers. Google Fonts: IP address and browser information when font files are requested.
jsDelivr Delivery of the GSAP JavaScript animation library on the Vestra Hosting website. IP address and browser information when the library files are requested.
Instatus Our public status page and the status widget shown on the Vestra Hosting website. IP address and browser information when the status page or widget loads.
Discord Community support, Discord verification, and routing careers applications and feedback to authorised Vestra staff. Discord user ID and username, messages you send to us, verification results, and careers application fields (including contact details, role, experience, motivation and skills) plus references to privately stored CV and signature files. Feedback contains the rating only. Careers IP addresses are not sent to Discord.
ipwhois.app IP address lookup during Discord verification, to detect VPN and hosting-provider connections and prevent abuse. IP address.
Gravatar (Automattic) Profile pictures shown in Vestra Passport. A hash of your email address, plus IP address and browser information when the image loads.
Veriwell Optional age verification, only if you choose to verify your age from your Passport account. A verification reference, the required age and the verification result. Any information you provide during verification is submitted directly to Veriwell.
Hetzner Primary server hosting and data centre infrastructure. Data stored on or passing through our servers, including account data, hosted content and service logs.
netcup Backup server nodes. Backup copies of data stored on our servers, including account data, hosted content and service logs.

Email

Account and service emails, such as sign-in, verification and password reset emails, are sent from an email server that Vestra owns and operates. No third-party email provider receives your data to send them.

International Transfers

Some of these providers may process personal data outside the UK. The available safeguard depends on the provider and destination and may be an adequacy regulation, contractual clauses, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU standard contractual clauses. Contact us for the safeguard used for a particular transfer. Vestra is reviewing its provider records and does not claim that a safeguard applies unless it has actually been put in place. See our Privacy Policy for more detail.

Changes to This List

When we add or replace a sub-processor, we update this page and its "Last Updated" date. Business customers covered by our Data Processing Addendum are notified by email and/or Discord before a new sub-processor starts processing their data, and may object as described in the Addendum.

Questions about our sub-processors can be sent to [email protected].