Vault 🇬🇧 🇩🇪 🇫🇷
  • Send
  • Request
  • How it works
  • Security & Trust
  • Pricing

    • Sub-processors

    Version and status of this document

    Version of 26.09.2026. We update this document as soon as the underlying processing operations, systems or sub-processors change.

    For a signed version, for questions regarding its content or for the conclusion of an individual data processing agreement, please contact hello@erseni.com.

    Sub-processors engaged

    The following overview lists all external service providers that we engage as sub-processors within the meaning of Art. 28 GDPR and with which personal data of the service is processed, that is content data, metadata or account data. Not listed are services that exclusively receive anonymous technical fault signals without any personal reference; personal details are removed before such signals are transmitted. None of the service providers listed obtains access to plaintext content.

    Company Purpose of the processing Location and region Data protection Hetzner Online GmbH Operation of the servers and the database, storage of the encrypted content and the associated metadata, and domain name resolution (DNS). Falkenstein data centre, Germany (EU). Privacy information
    DPA     Stripe Payments Europe, Ltd. Processing of payments and subscriptions for paid plans. For payment data, Stripe is a controller in its own right and not a sub-processor; we list Stripe here for the sake of completeness. No access to transaction data or transmitted content. Ireland (EU). Any processing in the USA is based on the EU-US Data Privacy Framework and, in the alternative, on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914). Privacy information

    We announce changes to the above list of sub-processors at least 30 days in advance by email and on this page. The controller may object to a change on data protection grounds within this period; the details are governed by the section on sub-processors in the data processing agreement.

    The actual content is encrypted on the end device beforehand. Neither we nor the service providers listed hold the key required for decryption.

    Systems we operate ourselves (not processing by a sub-processor)

    We operate the following systems ourselves, as Erseni Ltd. They are not sub-processors within the meaning of Art. 28 GDPR: there is neither an external contractual partner nor a separate data processing agreement to be concluded, and the right of objection described above does not apply to them. We list them here so that it is transparent which self-operated systems process data of the service and where they are located. These systems, too, obtain no access to plaintext content.

    System Purpose of the processing Location and region Data protection Stalwart Mail Server Dispatch of transactional email notifications, such as the notice that a request has been answered. The notifications contain no content. Instance operated by ourselves on rented infrastructure in Germany (EU); no external email service provider. Privacy information Matomo Analytics Cookieless reach measurement of the public pages and the logged-in area with a truncated IP address; raw data is deleted after 180 days. Used exclusively in the production environment and processes no content and no transaction data. Instance operated by ourselves on rented infrastructure in Germany (EU); no disclosure to third parties. Privacy information GitLab Recording of technical error reports for the purpose of fault resolution. Recorded are the error text, the call path and technical environment data; decrypted user content is not transmitted. Instance operated by ourselves on rented infrastructure in Germany (EU); no external service provider. Privacy information

    These systems run on the infrastructure of the hosting provider listed above and are covered by its entry to that extent.

    Product

    Security

    Legal

    Cancel contracts here © 2026 Erseni Ltd. Zero-knowledge by design.