Subprocessors
Version 2026-08-01 · Effective 1 August 2026
These are the third parties that process personal data on Aulay’s behalf. The list is complete as of the effective date above.
Subprocessors
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Hostinger | Hosting — the servers Aulay runs on | All service data, at rest and in memory | United States (Boston, Massachusetts) |
| Backblaze B2 | Encrypted off-site backups and audit archives | Complete nightly database backups — that is, everything described in the Privacy Policy — plus archived audit records | United States (us-east) |
| Cloudflare | DNS, network edge, TLS termination, DDoS protection | IP addresses and all HTTP and WebSocket traffic in transit; TLS is terminated at their edge | Global edge network |
| Stripe | Subscription billing and payment processing | Your email and payment details, which you give to Stripe directly; account and subscription identifiers, which we send | United States, with global processing |
| Zoho (ZeptoMail) | Transactional email — verification, password reset, invitations, notices | Recipient email address, subject and message body | Canada |
| GitHub | Desktop release downloads and internal deployment automation | Your IP address when you download a release | United States |
At your election
These receive data only if you choose a feature that uses them.
| Provider | When | Data received |
|---|---|---|
| GitHub, Google, Microsoft, Discord | If you sign in with that provider | They authenticate you and return your identifier, email and basic profile to us |
| Anysphere (Cursor) | If you use Cursor Cloud Agents | Your repository URL, branch and API key — Cursor clones your repository into its own cloud. See AI, your code, and model providers |
| Google (STUN) | When you use the remote display feature | Your browser contacts stun.l.google.com to establish the connection, disclosing your IP address. We intend to replace this with our own server |
Your AI provider is not our subprocessor
Anthropic, OpenAI, Google and the others receive your prompts and code because you signed in to their tools with your account. They process that data as your provider, under their agreement with you, not under ours. We never hold those accounts on your behalf. The full data path is here.
Self-hosted, and therefore not subprocessors
These components run on our own infrastructure. No third party is involved and no data leaves the systems already listed above: our object storage (MinIO), our source and container registry (Forgejo), and our metrics, logging and tracing stack (Prometheus, Grafana, Tempo).
What is not on this list, and never has been
There is no analytics provider, no advertising network, no session-replay tool, no crash or error-reporting service, and no customer-data platform anywhere in Aulay. This website loads no third-party scripts. We are stating this positively because it is unusual enough to be worth checking, and you can check it: view the source of any page.
Changes
We will update this page before adding a subprocessor, and the version and effective date at the top will change. To be told when it does, or to raise an objection, write to privacy@aulay.io.
Previous versions of this document are available on request.