Subprocessor List
Last updated: October 27th, 2026
These are the third parties that process personal data on our behalf, what each one does, and where it is. This list is part of the Data Processing Addendum.
We give at least 30 days' email notice before adding or replacing a subprocessor that processes personal data. You can subscribe to those notices in your portal under Notifications, or by emailing privacy@lasthourhosting.org.
1. Where your data actually lives
We would rather draw this than let you guess. Our servers, backups, and mail are in the United States. Two supporting services are not, and we say so on every page where we describe our infrastructure rather than only in fine print here.
| Layer | Provider | Where |
|---|---|---|
| Web, database, mail, backups (origin) | Subnet Digital LLC / EGI Hosting | United States |
| Content delivery (public static files) | Bunny.net | Global edge, including EU |
| DNS (zone records) | deSEC | Germany |
| Domain registration | Enom | United States |
2. Subprocessors
| Provider | Purpose | Personal data involved | Location |
|---|---|---|---|
| Subnet Digital LLC / EGI Hosting | Bare-metal and colocation hosting for our servers, network, and backups | All data held in the Services, including customer content; network-level IP addresses | United States |
| Bunny.net | Content delivery network for public static files and images | IP addresses of requesting visitors; publicly-requestable files only; no account data | Global edge (Slovenia-registered company) |
| deSEC | Authoritative DNS for domains we host | DNS zone records, which can include hostnames, mail records, and domain-verification tokens | Germany |
| Stripe, Inc. | Card payment processing | Name, email, billing address, card data (held by Stripe, not us), transaction records | United States |
| PayPal, Inc. | Payment processing where you choose PayPal | Name, email, transaction records | United States |
| Mollie B.V. | Payment processing where you choose Mollie | Name, email, transaction records | Netherlands |
| Enom, Inc. | Domain registration and renewal | Registrant name, address, email, phone for domains you register through us | United States |
| SignalWire, Inc. | SMS notifications you opt into (security alerts, ticket updates) | Mobile number, message content | United States |
| Our own mail server (mail.lasthourhosting.org) | Sending transactional and account email | Email addresses and message contents | United States |
| Our own backup infrastructure | Encrypted backups of account data and, where purchased, of customer content | All data in the Services | United States |
3. What is not on this list, and why
- No analytics processor. We do not use Google Analytics, Plausible, Matomo, or any other analytics service.
- No advertising or tag manager. We do not use ad networks, remarketing tags, or Google Tag Manager.
- No support desk SaaS. Support tickets are stored on our own servers, not in Zendesk or Intercom.
- No marketing automation. Marketing email is sent from our own mail infrastructure.
- No external font or script CDN. Fonts and scripts are served from our own domain.
- No session recording, heatmap, or error-tracking SaaS. We do not use FullStory, Hotjar, or Sentry.
4. Our own staff
Our staff are not subprocessors — they are us. Access to production systems is limited to named individuals, uses individual credentials, requires multi-factor authentication, is logged, and is reviewed when someone leaves. Access to customer content requires a support reason and is recorded in the audit log.
5. Legal process
We may disclose data to a government or law-enforcement body where the law requires it. That is a disclosure, not a processing arrangement, so it is not a subprocessor relationship. We review every request for legal sufficiency, challenge what we consider overbroad, notify the affected customer unless prohibited, and publish a transparency summary of the requests we receive.
6. Changes to this list
We will update this page and email subscribers at least 30 days before adding or replacing a subprocessor that processes personal data. You can object on reasonable data-protection grounds within 30 days; if we cannot resolve it, you may terminate the affected Service and we will refund the unused portion of any prepaid fee.
7. Questions
Email privacy@lasthourhosting.org.