Tigby Sub-processors
Last updated: 2026-08-27
neuraforce GmbH uses the following sub-processors to provide Tigby. All sub-processors are contractually bound under Art. 28 GDPR, and all processing takes place in the EU/EEA. We use no sub-processors outside the EU/EEA.
| Sub-processor | Seat | Role | Data | Location of processing |
|---|---|---|---|---|
| OVH GmbH | Saarbrücken, Germany | Dedicated servers, Additional IPs, backup storage | Service data on the two dedicated nodes, on ZFS-native-encrypted datasets with each node's key sealed to its own TPM; backups encrypted under their repository's own cipher (TOMs § 2) | Germany (Limburg an der Lahn) |
| OVH GmbH | Saarbrücken, Germany | Witness / monitoring VM: quorum vote, metrics, log collection, alerting, error tracking | Cluster-quorum state; operational metrics referenced by internal ID; log lines and application error reports from all three hosts, from which mail addresses and client IP addresses were replaced by a salted HMAC before leaving the sending host (retained 90 days); no mailbox content and no unredacted traffic data. This host is not encrypted at rest — it has neither TPM nor ZFS, and what may reach it is bounded instead (TOMs § 2, § 4) | Germany (Limburg an der Lahn) |
| Scaleway SAS | Paris, France | Break-glass outbound mail relay, standing but idle: Tigby delivers mail directly from its own servers, and the relay carries customer mail only while direct delivery is impaired. Alongside it, and continuously, Scaleway carries our own infrastructure alert mail; and the monthly encrypted backup copy (Object Storage) | Outbound email in transit (break-glass case only); alert messages about the state of the servers, containing no customer data; encrypted backup archives | France / EU |
| OVH SAS | Roubaix, France | Domain registrar and DNS for all tigby.*, tigbywire.* and tigbymail.* zones (fourteen domains) | DNS query metadata only; no customer content | France / EU |
Recipients that are independent controllers
| Recipient | Seat | Role |
|---|---|---|
| Mollie B.V. | Amsterdam, Netherlands | Payment processing for paid Plans. Mollie processes payment data as an independent controller under its own privacy statement; Tigby receives payment status, not full payment credentials. |
Change notification
We announce intended additions or replacements at least 30 days before they take effect, on this page and by email to account holders. Customers may object on reasonable data-protection grounds as set out in §6 of the DPA/AVV.