DATA PROCESSING

Subprocessors & Providers

Effective: 31 August 2026 · Version 2026-08-31

This register describes the providers used for SnapKey’s current production configuration. Contracting entities, account terms, locations, certifications and transfer safeguards depend on the applicable provider account and linked provider documents.

1. Cloudflare

ProviderCloudflare, Inc. and the applicable Cloudflare contracting entity.

ServicesWorkers hosting, network delivery and security, D1 application database and R2 managed object storage.

RoleProcessor/subprocessor for SnapKey infrastructure and managed storage.

DataPhotos in managed storage, project and photo metadata, request data, IP addresses, security logs and technical identifiers.

LocationSnapKey’s R2 managed-storage bucket uses EU jurisdiction. Network and support processing may still occur globally as described by Cloudflare.

The production account must incorporate Cloudflare’s applicable Data Processing Addendum. Transfers outside the EEA must rely on a valid Chapter V GDPR mechanism, such as the EU–US Data Privacy Framework where applicable or Standard Contractual Clauses with supplementary measures. See the Cloudflare DPA and Privacy Policy.

3. Dropbox selected by the Customer

ProviderDropbox, Inc. and the Customer’s applicable Dropbox contracting entity.

ServiceDropbox connected by the Customer through OAuth.

RoleNormally the Customer’s selected recipient or processor, not SnapKey’s managed-storage subprocessor, because the Customer controls the account and selects the destination.

DataUploaded photos, file metadata, application-folder paths and OAuth authorization data.

LocationDetermined by the Customer’s Dropbox product, account type, settings and contract.

Business, public-sector, school or association customers must verify that their Dropbox account and contract provide the processing terms, location and transfer safeguards required for their use.

2. Google Drive selected by the Customer

ProviderGoogle LLC and the Customer’s applicable Google contracting entity.

ServiceGoogle Drive connected by the Customer through OAuth.

RoleNormally the Customer’s selected recipient or processor, not SnapKey’s managed-storage subprocessor, because the Customer controls the account and selects the destination.

DataUploaded photos, file metadata, folder identifiers and OAuth authorization data.

LocationDetermined by the Customer’s Google product, account type, settings and contract.

Business, public-sector, school or association customers should use an account and contract that provide the required Art. 28 GDPR terms, commonly an eligible Google Workspace arrangement. A personal consumer Drive account must not be presented as providing a business AVV/DPA and may be unsuitable where the Customer requires a processor under Art. 28 GDPR. The Customer remains responsible for this provider choice.

Google may process data outside the EEA. The Customer must verify the applicable Data Processing Addendum, data-region options and Chapter V transfer mechanism. See the Google Workspace Data Processing Amendment and Google Privacy Policy.

3. Operator-managed Google storage

Operator-managed Google Drive should not be used as SnapKey’s production managed-storage service unless the exact business account is covered by an appropriate Art. 28 agreement and has been documented here as a subprocessor. The intended managed-storage backend is Cloudflare R2 with EU jurisdiction; any temporary operator Google Drive connection must be removed after migration and verified deletion.

4. PayPal payment services

ProviderPayPal (Europe) S.à r.l. et Cie, S.C.A. and applicable PayPal group entities.

ServiceCheckout, payment approval, capture and transaction records for managed storage.

RoleIndependent payment-services provider processing payment data under its own legal obligations and privacy terms.

DataTransaction amount, currency, order details, payer account and payment information, technical and fraud-prevention data.

See PayPal’s Privacy Statement.

5. Changes and objections

SnapKey will update this register before adding or replacing a subprocessor that processes Customer personal data. Customers should receive reasonable advance notice and may object on substantiated data-protection grounds under the Data Processing Agreement. Emergency changes required for security or legal compliance may be notified as soon as reasonably possible.

6. Contact

Questions about providers, transfer safeguards or the current production configuration can be submitted through the contact form.

← Back to SnapKey