Vault Send Request How it works Security & Trust Pricing 🇬🇧 🇩🇪 🇫🇷
  • Send
  • Request
  • How it works
  • Security & Trust
  • Pricing

    • Sub-processors

    Version and status of this document

    Please note: this document is a draft and remains subject to legal review and approval. In its present version it does not yet constitute a legally binding agreement.

    Version of 2026-07-27. We update this document as soon as the underlying processing operations, systems or sub-processors change.

    For a signed version, for questions regarding its content or for the conclusion of an individual data processing agreement, please contact hello@erseni.com.

    Sub-processors engaged

    The following overview lists all external service providers that we engage as sub-processors within the meaning of Art. 28 GDPR and with which personal data of the service is processed, that is content data, metadata or account data. Not listed are services that exclusively receive anonymous technical fault signals without any personal reference; personal details are removed before such signals are transmitted. None of the service providers listed obtains access to plaintext content.

    Company Purpose of the processing Location and region Data protection Hetzner Online GmbH Operation of the servers and the database, storage of the encrypted content and the associated metadata, and domain name resolution (DNS). Falkenstein data centre, Germany (EU). Privacy information Stripe Payments Europe, Ltd. Handling of payments and subscriptions for paid plans, including invoicing and payment data. No access to transmitted content. Ireland (EU) with processing in the USA on the basis of the standard contractual clauses. Privacy information

    We announce changes to the above list of sub-processors in advance. The controller may object to a change on important data protection grounds; the details are governed by the section on sub-processors in the data processing agreement.

    The actual content is encrypted on the end device beforehand. Neither we nor the service providers listed hold the key required for decryption.

    Systems we operate ourselves (not processing by a sub-processor)

    We operate the following systems ourselves, as Erseni Ltd. They are not sub-processors within the meaning of Art. 28 GDPR: there is neither an external contractual partner nor a separate data processing agreement to be concluded, and the right of objection described above does not apply to them. We list them here so that it is transparent which self-operated systems process data of the service and where they are located. These systems, too, obtain no access to plaintext content.

    System Purpose of the processing Location and region Data protection Stalwart Mail Server Dispatch of transactional email notifications, such as the notice that a request has been answered. The notifications contain no content. Instance operated by ourselves on rented infrastructure in Germany (EU); no external email service provider. Privacy information Matomo Analytics Reach measurement of the public pages. Used exclusively in the production environment and processes no content and no transaction data. Instance operated by ourselves on rented infrastructure in Germany (EU); no disclosure to third parties. Privacy information GitLab Recording of technical error reports for the purpose of fault resolution. Recorded are the error text, the call path and technical environment data; decrypted user content is not transmitted. Instance operated by ourselves on rented infrastructure in Germany (EU); no external service provider. Privacy information

    These systems run on the infrastructure of the hosting provider listed above and are covered by its entry to that extent.
    Security & Trust Solutions Comparisons Pricing Status Source Privacy Policy DPA Imprint security.txt © 2026 Erseni Ltd. Zero-knowledge by design.