Trust
Sub-processors
Shorter than you are used to, because most of these are ports rather than vendors — and if you self-host, the list is empty.
The list
| Purpose | Provider | Notes |
|---|---|---|
| Application and database hosting | Whoever hosts your instance | If we host it for you, our infrastructure provider. If you self-host, yours — and we are not a processor at all. |
| Object storage (uploads, media) | Configured by you | Local disk, any S3-compatible service, or Azure Blob. Chosen by an environment variable. |
| Email delivery | Configured by you | Any SMTP server. We do not require or bundle a particular provider. |
| Search | None, or Meilisearch | PostgreSQL by default — in which case there is no separate service at all. |
| AI generation | Configured by you, or nobody | OpenAI, Azure OpenAI or Anthropic. The default is disabled, and while it is, no text leaves your instance. |
| Website analytics | Nobody | Self-hosted, cookieless and aggregate. No analytics vendor receives anything. |
The list is short for a structural reason rather than a marketing one: storage, mail, search, AI and cache are ports with drivers, selected by an environment variable, and no cloud-provider SDK is imported in feature code. Nothing in the product assumes a particular vendor, which is why nothing on this page does either.
We update this page before adding a sub-processor, not afterwards. On a paid plan we tell you directly.
And this website
Makes no request to any host but itself. No font CDN, no tag manager, no chat widget, no CAPTCHA, no embedded video. The content-security policy is default-src 'self', relaxed only for the inline script and style the framework needs to boot, and a browser test fails the build if it widens. Verify it in your own network tab — which is rather the point.
The rest of the trust documents
Data processing, responsible disclosure, the accessibility statement and the honest build status.
Or open the sandbox (opens in a new tab) and click around first. No form.