# Sub-processors

> The sub-processors Cloo GmbH uses for MIRA FIVE, where they process data, and which service providers are not sub-processors.

URL: https://mirafive.io/subprocessors  
Updated: 2026-09-28

[Deutsche Fassung](https://mirafive.io/de/unterauftragsverarbeiter)

This list belongs to our [Data Processing Agreement](https://mirafive.io/dpa) (Annex 3). It names the companies that process personal data from your customer data on our behalf. That is mainly data about the visitors of your websites and apps. The German version is authoritative.

Last updated: 28 September 2026

## Sub-processors

| Sub-processor                                                          | Service                                                                                                                                            | Place of processing                                                                     |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany     | Data centre and servers for the entire service (Nuremberg), for error monitoring and operations (Falkenstein) and for encrypted backups (Helsinki) | Germany; backups Finland (EU)                                                           |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Email mailboxes (Google Workspace), only where you send us personal data in support requests                                                       | EU; transfer to the USA possible (Data Privacy Framework, standard contractual clauses) |

The service itself, its databases and the collection endpoints run only on servers of Hetzner Online GmbH in Germany. Hetzner’s data centres are ISO/IEC 27001 certified. Backups are encrypted on our servers before they leave the data centre.

For Google Workspace, a transfer to the USA relies on Google LLC’s certification under the EU-U.S. Data Privacy Framework and on the European Commission’s standard contractual clauses. Only send us personal data about your visitors when a support request really needs it.

## Not sub-processors

We use these service providers, but they do not process customer data on our behalf:

| Service provider                                                     | Task                                                              | Why it is not a sub-processor                                                   |
| -------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| Sinch Mailjet SAS, 13-13 bis rue de l’Aubrac, 75012 Paris, France    | Sending the emails from MIRA FIVE                                 | The emails only go to members of your organisation and contain no visitor data. |
| Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands       | Payment processing                                                | Mollie processes payment data as an independent controller.                     |
| BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia | Delivery and DNS of our websites mirafive.io and docs.mirafive.io | Concerns only our websites, no customer data.                                   |
| CrowdSec SAS, France                                                 | Defending our servers against attacks                             | Only receives the IP addresses of detected attackers, for our own security.     |

Platforms you connect yourself, such as Google Search Console, Google Ads, Meta Ads and Bing Webmaster Tools, are not sub-processors either. The same applies to API clients and AI assistants you connect through the API or the Model Context Protocol (MCP). You choose these recipients, and data only flows to them on your instruction.

## Changes to this list

Before we add or replace a sub-processor, we inform the owners of all organisations by email at least 30 days in advance and update this page. You can object to the change on reasonable data protection grounds within 14 days. Section 5 of the [Data Processing Agreement](https://mirafive.io/dpa) sets out the details.

Questions about this list: [](mailto:hello@mirafive.io)[hello@mirafive.io](mailto:hello@mirafive.io).