Who else touches your data
Three companies, one job each. This page is the current list rather than a category of companies we might use, so it can be checked against reality — and it is updated before a new sub-processor starts, not after.
Last updated 5 September 2026
The list
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Niobe Bilişim Ltd. Şti. | Hosts the server that runs the site, the account application, the database and our mail server | Everything we hold, as data at rest on their infrastructure. They have no reason to read it and no application access. | Türkiye |
| Polar Software, Inc. | Merchant of record: runs the checkout, stores the payment method, charges renewals, issues the invoice and handles the tax | Billing name and address, payment details, purchase history. As the seller of record and for its own legal duties Polar acts as a controller of the payment data, not merely our processor. Polar processes card payments through its own payment processor, Stripe. | United States |
| Cloudflare, Inc. | Authoritative DNS for attestkeep.com, and the Turnstile bot check on the sign-up, sign-in, password-reset and contact forms | DNS queries for our hostnames. When one of those forms is submitted, the signals Turnstile evaluates in the browser (IP address, browser characteristics) and the one-time token it issues, which our server asks Cloudflare to confirm. The proxy is off, so page requests and account traffic do not pass through them. | United States, global network |
Transfers outside Türkiye. Polar is in the United States and receives the payment data as the seller of record, under its own terms and privacy policy published at polar.sh. Cloudflare's terms include the standard data protection clauses and it receives DNS queries only. Both are engaged under written terms that bind them to confidentiality and to security measures no weaker than our own.
Who is not on it
No analytics provider, no advertising network, no tag manager, no CDN in front of the pages, no customer relationship or support platform, no e-mail marketing service, and no AI service. Mail is sent from our own server rather than through a delivery provider, so the contents of a licence key e-mail pass through no third party.
The product you install in your cluster has no sub-processors at all: it reaches exactly one endpoint, ours, with the three values the privacy notice lists.
How changes are announced
When a sub-processor is added or replaced, this page changes first and the date at the top moves. Where the change affects data we already hold, we also tell account holders by e-mail at least 30 days before it starts, so there is time to object — and objecting is a reason to cancel without penalty if we cannot resolve it.
Questions go to legal@attestkeep.com. If you need this as a signed annex to the data processing terms, ask and you will get it.