Subprocessors

Hetzner Online GmbH (Germany / EEA) — production compute, network, database and managed media storage on operator-controlled infrastructure; encrypted operational backups may also use Hetzner services.

Cloudflare, Inc. and applicable affiliates (United States / global network) — DNS, proxy and traffic protection, TLS delivery, Turnstile abuse prevention and outbound service email. Cloudflare may process network identifiers, request metadata, challenge signals and email delivery data.

Stripe Payments Europe, Limited and applicable Stripe affiliates (Ireland / global) — Checkout, recurring subscriptions, fixed storage add-ons, invoices, payment processing, billing portal and fraud prevention. Stripe receives billing contact, transaction and payment data; KORD does not store full card details.

KORD does not expose customer AI-provider configuration in workspace settings. External agents and model services selected by a customer operate under the customer's separate agreement.

OpenAI Ireland Limited / OpenAI, L.L.C., Anthropic, PBC or Replicate, Inc. may process limited customer content only for a separately enabled operator-managed automation or legacy contractual feature. They are not part of the standard public-plan publishing path.

The request is limited to the content and context needed for that separately enabled operation. If no such operation is enabled, KORD does not send workspace content to these providers.

Social platforms are not listed as KORD subprocessors merely because KORD transmits a post to them. The customer chooses the destination, grants the provider permission and instructs KORD to send the relevant profile, media, caption, schedule and publishing data. The platform then processes that data under its own terms and privacy policy, commonly as an independent controller.

• Meta Platforms Ireland Limited — Facebook Pages and Instagram Business.
• X Corp. and applicable affiliates — X profiles.
• LinkedIn Ireland Unlimited Company and applicable affiliates — LinkedIn members and organizations.
• Google Ireland Limited / Google LLC — YouTube channels and YouTube API Services.
• TikTok Technology Limited and applicable affiliates — TikTok profiles and Content Posting API.

KORD may disclose limited data to professional advisers, auditors or authorities when required by law or reasonably necessary to protect rights and investigate security or abuse. These recipients are not subprocessors when they determine their own legal obligations.

The operator does not use a behavioral-advertising or cross-site analytics subprocessor. Cookieless website usage statistics run on Umami, self-hosted by the operator on its own EEA infrastructure, so no additional party receives them.

Primary production hosting is in the EEA. A subprocessor's support, security or network operations may involve other countries. Where GDPR requires a transfer mechanism and no adequacy decision applies, KORD uses the European Commission Standard Contractual Clauses and supplementary safeguards where appropriate.

A customer-directed transfer to a connected social platform or customer-contracted external agent follows that provider's terms and the customer's instructions. Customers should review the destination provider's location and safeguards before connecting it.

This page is KORD's current subprocessor list and notice channel. We will date updates and, where reasonably possible, publish a material addition or replacement before it processes customer personal data.

A customer may object to a new subprocessor on reasonable data-protection grounds by contacting [email protected] within 15 days of the update. Include the workspace, affected processing and reason for the objection so we can assess an alternative.