To deliver the Services, Stateward relies on a small number of trusted subprocessors, each bound by GDPR-compliant terms. This page lists the current subprocessors, in line with our Data Processing Agreement.
The list below is a working draft to be confirmed against the live stack before publication. Verify each entity, role and location.
Current Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Marketing website hosting and traffic analytics | United States / EU edge |
| Stripe Payments Europe, Ltd. | Payment processing and billing | Ireland (EU); card data may be processed by Stripe, Inc. (US) under Standard Contractual Clauses |
Application hosting, AI-powered analysis, and storage of code, findings and security data run on Citadea, Yggdrasil Digital's own sovereign EU infrastructure. This is first-party infrastructure, not a third-party subprocessor. We do not send your code to any third-party AI provider. Where Citadea relies on an underlying data-centre or cloud provider, that provider is listed here: Hertzner.
Code-host integrations (GitHub, GitLab, Bitbucket) and identity providers (Google) are platforms you connect; they act under their own terms, not as our subprocessors.
Change Notification
We will give at least thirty (30) days' notice before adding or replacing a subprocessor, by updating this page (with a new "Last updated" date) or by email. To be notified of changes, or to object on reasonable data-protection grounds, contact privacy@stateward.com.