The short list of third parties that may process personal data on our behalf, and exactly why. We announce changes to this list at least 30 days in advance, as promised in the DPA.
| Vendor | Location | Purpose | Data involved |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Ireland (EU) | Card payments, subscription billing, and invoicing for customers paying by card. | Name, email, billing address, payment status. Card numbers go to Stripe directly and never touch Værft. |
| PensoPay A/S | Denmark (EU) | Payment processing for customers paying via Danish payment methods. | Name, email, billing address, payment status. Card numbers go to PensoPay directly and never touch Værft. |
Most of the platform involves no third party at all. Build and runtime infrastructure, databases, object storage for backups, logging and metrics, and transactional email are all operated by Værft on infrastructure in the European Union. Your applications and their data are not handed to a hyperscaler behind your back.
When you connect a git provider (GitHub, GitLab, Gitea, Codeberg, or a self-hosted instance), Værft talks to it on your instruction and with the access you granted. The same goes for notification targets you configure, such as Slack or Discord webhooks. These are your vendors, chosen and controlled by you — they act for you, not for us, so they are not subprocessors under the DPA.
Before adding or replacing a subprocessor we announce it at least 30 days in advance by email or in the dashboard. If you have a reasonable objection, write to [email protected] — the process is described in section 05 of the DPA.