Sub-processors

Overview

Swiftmade OÜ ("we," "our," or "us") uses a small number of third-party service providers (sub-processors) to deliver the GitLoom service. Each sub-processor is bound by a data processing agreement and appropriate confidentiality and data protection obligations. Where a sub-processor processes data outside the European Economic Area, transfers are safeguarded by Standard Contractual Clauses or an equivalent lawful transfer mechanism. This page lists our current sub-processors, what they do for us, and where they process data.

Current Sub-processors

• ▸Hetzner Online GmbH (Germany, EU): Cloud infrastructure and hosting. All GitLoom application data is stored on Hetzner servers in EU data centers, encrypted in transit and at rest.
• ▸Paddle: Payment processing and merchant of record. Paddle processes and stores payment card details, billing addresses, and transaction history. We do not store full payment card details ourselves.
• ▸PostHog (EU): Product analytics. PostHog processes usage data (page views, feature usage, session replays) on servers located in the European Union.
• ▸Amazon Web Services, AWS SES (EU region): Transactional email delivery, such as account notifications and service emails. AWS processes recipient email addresses and the contents of the emails we send you on servers located in the European Union.
• ▸TypeSafe AI, Inc. (United States): AI processing for classification and ranking. Repository metadata (pull request titles and descriptions, commit messages, review comment text, branch and changed-file names, and status) is sent to TypeSafe to categorise pull requests, judge whether a review thread has been settled, rank search results, and check generated answers before they are delivered; source code, credentials, and payment data are never sent. TypeSafe states that it does not train or fine-tune models on customer input. Retention is governed by our data processing agreement with TypeSafe, which incorporates Standard Contractual Clauses for transfers outside the European Economic Area.
• ▸OpenAI (United States): AI processing for question answering and digest summaries. Only repository metadata (commit messages, pull request titles and status, contributor activity) is sent to OpenAI; source code, credentials, and payment data are never sent. API data is not used to train models and is retained by OpenAI for a maximum of 30 days solely for abuse monitoring. Transfers are covered by our data processing agreement with OpenAI, incorporating Standard Contractual Clauses.

Changes to This List

We may add or replace sub-processors from time to time as the Service evolves. When we do, we will update this page before the new sub-processor begins processing customer data. If you have questions or objections regarding a sub-processor, contact us at [email protected].

Contact Us

If you have questions about our sub-processors or data practices, please contact us: By email: [email protected] By mail: Swiftmade OÜ, Pärnu mnt 148, 11317, Tallinn, Estonia