Sub-processors
The service providers that process personal data on empiri’s behalf, and the integrations an organization can turn on itself.
Draft — pending legal review
Last updated: November 6, 2026
Sub-processors
| Provider | Purpose | Data | Applies to | Location | Transfer mechanism |
|---|---|---|---|---|---|
| HetznerHetzner Online GmbH | Hosting of the application, database and uploads. | All data the service processes (hosting) | Both | Germany (entity and data centres) | Adequacy decision (no restricted transfer) Switzerland and the EU/EEA recognise each other’s data-protection level. |
| ResendResend, Inc. | Transactional email, including participant invitations and reminders. | Recipient address, message content, delivery status | Both | United States (entity) | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Resend transfer mechanism] |
| StripeStripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing and payments. | Billing contact and address, VAT ID, subscription status; never respondent data | empiri as controller | Ireland (EU entity) and United States | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Stripe transfer mechanism] |
| MetanetMetanet AG | Hosting of empiri’s self-hosted Umami analytics instance (stats.godstone.ch). | Website and admin-app visit statistics (cleaned page path, browser, device class, country); never survey or response data | empiri as controller | Switzerland | Adequacy decision (no restricted transfer) Switzerland is an adequacy country under the EU GDPR and the processing is domestic under the Swiss FADP, so no restricted transfer and no Standard Contractual Clauses are involved. |
| CloudflareCloudflare, Inc. | Authoritative DNS (not proxied, so no content traffic) and R2 storage for encrypted off-site backups. | DNS queries for empiri.ch hostnames; Age-encrypted backups (ciphertext only) | Both | DNS: global network. R2 backups: EU jurisdiction. Entity: United States. | Data Privacy Framework or Standard Contractual Clauses with Swiss addendum [VERIFY: Cloudflare transfer mechanism] |
Integrations an organization configures
These transmit data on the organization’s own instruction. They are the organization’s recipients, not empiri sub-processors.
- DeepL — Machine translation, only when the organization enables it with its own key. Only authored survey text is sent, never responses. (Germany)
- Anthropic — Machine translation, only when the organization enables it with its own key. Only authored survey text is sent, never responses. (United States)
- Webhooks — Outbound notifications to endpoints the organization configures. Event data as configured by the organization, sent to the URL it chooses.
- API / MCP — Clients the organization authorizes with an API key, including MCP clients. Data the organization’s key is permitted to read or write.
Analytics
empiri’s analytics runs on a self-hosted Umami instance at stats.godstone.ch, hosted by Metanet in Switzerland (listed in the table above). It receives no survey or response data.
Change notice
We announce new or replaced sub-processors for customer data at least [SUBPROCESSOR_NOTICE_DAYS] days in advance by email to every organization Owner and in the release notes. An organization can object under the data-processing agreement.
Change log
- — Initial publication of the sub-processor list.