Who else touches your data
Three companies, one job each. This page is the current list rather than a category of companies we might use, so it can be checked against reality — and it is updated before a new sub-processor starts, not after.
Last updated 27 August 2026
The list
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Niobe Bilişim Ltd. Şti. | Hosts the server that runs the site, the account application, the database and our mail server | Everything we hold, as data at rest on their infrastructure. They have no reason to read it and no application access. | Türkiye |
| Paddle.com Market Ltd | Merchant of record: takes the payment, issues the invoice, handles VAT | Billing name and address, payment details, purchase history. They are a controller for this, not merely our processor. | United Kingdom |
| Cloudflare, Inc. | Authoritative DNS for attestkeep.com | DNS queries for our hostnames. The proxy is off, so no page request and no account traffic passes through them. | United States, global network |
Transfers outside Türkiye. Paddle is in the United Kingdom, which the European Commission recognises as offering adequate protection, and its contract with us carries the standard data protection clauses. Cloudflare's terms include the same clauses and it receives DNS queries only. Both are engaged under written terms that bind them to our instructions, to confidentiality and to security measures no weaker than our own.
Who is not on it
No analytics provider, no advertising network, no tag manager, no CDN in front of the pages, no customer relationship or support platform, no e-mail marketing service, and no AI service. Mail is sent from our own server rather than through a delivery provider, so the contents of a licence key e-mail pass through no third party.
The product you install in your cluster has no sub-processors at all: it reaches exactly one endpoint, ours, with the three values the privacy notice lists.
How changes are announced
When a sub-processor is added or replaced, this page changes first and the date at the top moves. Where the change affects data we already hold, we also tell account holders by e-mail at least 30 days before it starts, so there is time to object — and objecting is a reason to cancel without penalty if we cannot resolve it.
Questions go to legal@attestkeep.com. If you need this as a signed annex to the data processing terms, ask and you will get it.