Subprocessors
Every third party that can touch customer data, what they do, and where they do it.
Last updated on 18 September 2026
Draft. Some details of the company are still being registered, so this document is not final and is not indexed by search engines.
A subprocessor is a company we hire that can process data you put into Quathos Room. This is the complete list. We notify customers before adding one, with enough time to object.
1. Current subprocessors
| Company | What it does | Data it can reach | Where |
|---|---|---|---|
| Hetzner Online GmbH | Servers, private network and object storage. The whole product runs here. | Everything at rest: messages, files, meeting records, account data. | Germany (Falkenstein and Nuremberg) |
| Stripe, Inc. | Subscription payments. Card data goes to Stripe directly and never touches our servers. | Billing name, billing email, payment method, invoice history. | United States and Ireland |
| Cloudflare, Inc. | Authoritative DNS for quathos.com. It answers where our servers are, and no traffic passes through it: the records are not proxied. | None. DNS queries only. | Global |
| Quathos Account (Quathos LLC) | Sign in for the whole family. It is the only door: Quathos Room has no password of its own. | Name, email, organization membership. | Germany (Falkenstein and Nuremberg) |
| Quathos Mailer (Quathos LLC) | Transactional email: meeting invitations, reminders, RSVP answers. | Recipient address, meeting title, time and link. | Germany (Falkenstein and Nuremberg) |
| Quathos SMS (Quathos LLC) | One time codes for external guests, where the meeting asks for one. | Phone number and the code. | Carrier routes worldwide |
2. Why our own products are on the list
Quathos Account, Quathos Mailer and Quathos SMS belong to Quathos LLC, the same company that operates Quathos Room. They are listed anyway, because for the person evaluating us what matters is that an invitation email leaves through another system, with its own logs and its own retention. Sharing a legal entity does not make it invisible.
3. Changes
Before a new subprocessor starts, we announce it here and email the administrators of each customer. A customer who objects on reasonable data protection grounds may terminate the affected service without penalty, as the DPA describes.
Questions about this list go to privacy@quathos.com.