< Back to Overview
MoreThanDigital’s Sub-Processors
Last updated 02.06.2026
To deliver our Services, MoreThanDigital works with a limited number of carefully selected third-party providers (“sub-processors”) that process personal data on our behalf. We enter into a data processing agreement with every sub-processor, and we require each to provide protections at least equivalent to those set out in our Privacy Policy and our International Transfers page.
A provider is listed below if it processes personal data on our behalf in any form — including where it only stores or transmits data, or operates infrastructure that holds it, even if it does not actively access the contents. User account data is stored exclusively on dedicated infrastructure within the European Union; the providers below support delivery, infrastructure, communication, and payment.
Current Sub-Processor
| Provider | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of all user and account data on dedicated infrastructure | All platform data | Germany / Finland (EU) | Within EU — no transfer |
| elest.io | Management and orchestration of our self-hosted identity service (Zitadel), which runs on our own Hetzner servers | Identity and authentication data resides on our infrastructure; the provider supplies management tooling | EU | Within EU — no transfer |
| Bunny CDN (BunnyWay d.o.o.) | Content delivery network — caches and serves public static media (images, files) | Technical request data such as IP address, used only to deliver content; does not hold user account databases | EU-based provider; global edge delivery | EU provider |
| Cloudflare, Inc. | DNS and CDN / edge network (domain resolution, traffic routing, caching, security/DDoS protection) | Technical request data such as IP address and request metadata, processed to route and protect traffic; does not hold user account databases | United States (global edge) | Standard Contractual Clauses |
| Stripe, Inc. | Payment processing | Billing details, transaction data, payment references | United States | Standard Contractual Clauses |
| aki.io | AI-assisted analysis of submitted article content prior to publication | Article text (which may contain personal data) and author metadata | [confirm region] | Standard Contractual Clauses (if processed outside the EEA) |
| DeepInfra, Inc. | AI inference for document classification and AI-assisted writing/analysis features | Text submitted for inference, processed transiently in memory only | United States | Standard Contractual Clauses; inputs processed in memory for the duration of the request and not stored, logged, or used for training |
| Together AI (Together Computer, Inc.) | AI inference for document classification and AI-assisted writing/analysis features | Text submitted for inference, processed transiently in memory only | United States | Standard Contractual Clauses; inputs processed in memory for the duration of the request and not stored, logged, or used for training |
| Amazon Web Services, Inc. | Email delivery relay | Email address, email content | United States | Standard Contractual Clauses |
| EmailLabs (Vercom S.A.) | Email delivery | Email address, email content | Poland (EU) | Within EU — no transfer |
| MoreThanDigital mail servers | Email delivery | Email address, email content | EU | Operated by us |
| IONOS SE | VPS, storage and hosting for marketing websites and other supporting services (compute + redundancy) | Website visitor data; data held on rented infrastructure | Germany (EU) | Within EU — no transfer |
| OVHcloud (OVH SAS) | VPS, storage and hosting for marketing websites and other supporting services (compute + redundancy) | Website visitor data; data held on rented infrastructure | EU (France / Germany) | Within EU — no transfer |
| RunPod, Inc. | Rented GPU compute (spot/on-demand) for machine translation and text-to-speech generation | Article content (which may contain personal data), processed transiently in memory only during the batch | Region-selectable; prefer EU; non-EEA possible | Standard Contractual Clauses for any non-EEA processing; data not persisted on the rented instance |
| Vast.ai (Vast.ai, Inc.) | Rented GPU compute (marketplace/spot) for machine translation and text-to-speech generation | Article content, processed transiently in memory only during the batch | Marketplace hosts; location may vary | Standard Contractual Clauses for non-EEA processing; data not persisted on the rented instance; see note below |
| Spheron Network | Rented GPU compute (decentralized/spot) for machine translation and text-to-speech generation | Article content, processed transiently in memory only during the batch | Distributed network; location may vary | Standard Contractual Clauses for non-EEA processing; data not persisted on the rented instance; see note below |
AI Inference Providers — Note on Data Handling
Where we use external AI inference (aki.io, DeepInfra, Together AI) for document classification, content analysis, or AI-assisted writing, the text submitted is processed transiently — held in memory only for the moment it is sent, inferred, and returned — and is not written to storage, logged, or used to train the provider’s models. Nothing submitted for inference persists with the provider after the request completes. This lets us run AI features securely without our content becoming part of a third party’s records or training data. Each provider is bound by a data processing agreement and, where it processes data outside the EEA, by Standard Contractual Clauses.
GPU Compute for Translation & Audio
Machine translation and text-to-speech (“Listen to Article”) audio are generated using rented GPU compute from the providers listed above (RunPod, Vast.ai, Spheron), using our own models and software. Article content is processed transiently — held in memory only for the duration of the batch and not written to persistent storage on the rented instance — and the compute environment is torn down after processing. Where GPU capacity is located outside the EEA, the transfer is governed by Standard Contractual Clauses. We prefer EU-region and named-datacenter capacity for content containing personal data.
Changes to This List
We may update this list as our Services evolve. Material changes — such as the addition of a new sub-processor — will be reflected here with an updated date above. Where required under an applicable data processing agreement, we will notify affected customers of changes in advance so they may exercise any contractual rights.
Questions
For any questions regarding our sub-processors or to request a copy of a data processing agreement, please contact our Data Protection Officer at