G8KEPR uses a limited set of third-party sub-processors to deliver our service. This page enumerates them as required by GDPR Article 28, with DPA links and clear scope of the data each may access.
Last updated: 2026-09-27 · 30-day advance notice before adding new sub-processors
In a self-hosted deployment, G8KEPR runs inside your infrastructure and your API traffic, threat findings, AI gateway logs and sensor telemetry stay there. On the hosted service, customer data is stored with DigitalOcean (listed below). When you configure the AI Gateway to route requests to an LLM provider, the prompt content you send goes to that provider under your configuration.
| Sub-Processor | Purpose | Data Accessed | Location | DPA |
|---|---|---|---|---|
DigitalOcean | Control plane hosting (API servers, database, object storage) | Tenant configurations, control-plane audit logs, billing data, customer metadata | United States (NYC) | View DPA → |
Stripe | Payment processing and subscription management | Billing contact information, payment metadata (no full card numbers — tokenized by Stripe) | United States | View DPA → |
Sentry | Error tracking and crash reporting (control plane only) | Error metadata, stack traces, request context — no customer-VPC sensor data | United States | View DPA → |
SendGrid (Twilio) | Transactional email (account alerts, billing receipts, security notifications) | Email addresses, email content of transactional messages | United States | View DPA → |
Purpose: Control plane hosting (API servers, database, object storage)
Data: Tenant configurations, control-plane audit logs, billing data, customer metadata
Location: United States (NYC)
Purpose: Payment processing and subscription management
Data: Billing contact information, payment metadata (no full card numbers — tokenized by Stripe)
Location: United States
Purpose: Error tracking and crash reporting (control plane only)
Data: Error metadata, stack traces, request context — no customer-VPC sensor data
Location: United States
Purpose: Transactional email (account alerts, billing receipts, security notifications)
Data: Email addresses, email content of transactional messages
Location: United States
We provide at least 30 days' advance notice before adding a new sub-processor. Notifications go to the billing contact email on file for your account.
If you object to a new sub-processor within the notice period, contact security@g8kepr.com. We will work with you to find an alternative or discuss your specific requirements.
Contact our security team to discuss DPA execution, data residency requirements, or your specific compliance needs.