Subprocessor list#

For customer content and account data, we use exactly one subprocessor:

All production systems - including our self-hosted identity service - run on Hetzner infrastructure in the EU. There is no CDN, no third-party analytics, and no US cloud provider processing personal data.

Not personal-data subprocessors, listed for transparency:

• Let's Encrypt (ISRG) issues our TLS certificates and receives only domain names during issuance.
• Cloudflare and Google public DNS resolvers are queried over DNS-over-HTTPS during customer-domain verification; they receive only the domain names being checked, never personal data.
• The websites whose icons are requested are contacted by our servers to fetch their favicons; they see requests from our EU infrastructure, never from your visitors.

Change notice: material changes to this list are announced on this page before they take effect. The canonical version of this document lives at https://icon0.eu/legal/subprocessors. Roles under the GDPR are described in the Data processing agreement.

Last updated: August 2026.