Subprocessors
Every third party that touches personal data on our behalf. The list is short by design.
Version 2026-09-05 · Applies to the Titan Logs service
Current subprocessors
| Provider | What it does | Data it can reach | Location | Transfer basis |
|---|---|---|---|---|
| Hosting provider — OPERATOR: fill in | Rents the virtual server that runs the Titan Logs application, its PostgreSQL database and its Redis cache. All three run as containers on this one machine, so there is no separate database or cache vendor. | All account data and all log data, at rest on the machine's disks. | OPERATOR: fill in | If EEA: none required. If outside the EEA: OPERATOR: fill in (adequacy decision or Standard Contractual Clauses). |
| Off-host backup storage — OPERATOR: fill in | Stores encrypted database backups, rotated after 30 days. Archives are encrypted with AES-256 before they leave the server, so the provider never holds readable data. | Encrypted database dumps only. Not readable without the passphrase, which the provider never has. | OPERATOR: fill in | OPERATOR: fill in |
| Titan Auth (auth.titansoftware.eu) | Identity and billing for the whole Titan Software product line. Signing in to Titan Logs authenticates against it, and your plan and payment status come from it. | Your name, email address, organization and subscription status. It never sees your log data. | Operated by Titan Software z.s. on the same infrastructure | Not a transfer — same controller |
| Email relay (SMTP) — not currently configured | Would deliver member invitation emails. With no relay configured, invitations are shared as a copy-and-paste link instead and no email leaves the service. | Would receive the invitee's email address, the inviter's email address, the organization name and the invitation link. | n/a | n/a — update this row before enabling SMTP |
What we deliberately do not use
There is no analytics provider, no error-monitoring SaaS, no CDN, no advertising or marketing platform, no object-storage vendor, no AI or machine-learning provider, and no third-party JavaScript of any kind in the dashboard. Web fonts are compiled into our own build and served from our own domain, so loading a page does not reveal your visit to anyone else.
This is a design choice, not an oversight, and it is why the table above is four rows long.
Changes to this list
We give at least 30 days' notice by email to organization owners before adding or replacing a subprocessor. If you object on reasonable data-protection grounds you may terminate and receive a pro-rata refund of prepaid fees — see §7 of the Data Processing Agreement.
Version 2026-09-05. Questions: [email protected].