Sub-processors and Service Providers
Last Updated: 8 October 2026 | Version 1.4
This register separates providers that may process Customer Personal Data for a customer from providers Telmetra uses for its own controller activities and destinations selected by customers. It does not state a provider’s region, international-transfer mechanism, certification, or contractual role beyond what is verified for the relevant service and deployment.
1. Customer-data subprocessors
These providers may process Customer Personal Data only in the circumstances described below.
- Vultr (The Constant Company, LLC): hosting of the Service and related customer data. The instance is in Frankfurt, Germany. The provider is established in the United States; processing is under a written data processing agreement, including Standard Contractual Clauses where required.
AI provider. OpenAI is not listed here today: the AI-assisted features send it only the data described in section 2.
If further infrastructure or support providers are engaged to process Customer Personal Data, Telmetra will update this register and handle them in accordance with the applicable DPA and law.
2. Telmetra controller-side service providers
Telmetra may use the following providers for its own account, billing, website, security, support, analytics, or administration activities. They are listed here for transparency and are not automatically subprocessors of Customer Personal Data.
- Stripe: payment processing and billing support for card or online payment flows; Telmetra may also issue bank-transfer invoices without Stripe.
- Resend: transactional email delivery, including alert and notification e-mails, which carry the alert text, the computer name, and the client name.
- Web push services: when a user turns on push notifications, the notification text (computer name and alert text) is delivered through the push service of that user’s browser vendor.
- Google services: analytics (Google Analytics), sign-in (Google sign-in and One Tap), and web fonts (Google Fonts) where enabled.
- Crisp: customer-support chat where enabled.
- Apollo: website visitor analytics for sales and marketing, loaded only after the marketing choice in the cookie panel.
- LogRocket and Application Insights: session replay, diagnostics, and performance monitoring where enabled. The browser-side tools load only after the matching cookie choice; the server-side part of Application Insights collects request and error diagnostics without cookies. LogRocket is the session-replay tool: it is not loaded on the pages that show a remote session or take a Quick Support code, and it is also given a signed-in user’s name, e-mail address, role, and organization details.
- ErrorHub: error reporting from the website and the Service: exception type, message and stack trace, the page path, and the release version; for errors on the server it also receives the signed-in user’s identifier.
- Cloudflare and Turnstile: network delivery, security, and bot protection where enabled.
- Content delivery: web pages load fonts, icons, and script libraries from Google Fonts, Cloudflare (cdnjs), jsDelivr, and the DataTables CDN, and the payment page loads Stripe.js. Each request discloses the visitor’s IP address and browser details to that provider.
- OpenAI: AI-assisted features where enabled. (a) Administrative content assistance: for Telmetra administrators; the feature should not be used to submit Customer Personal Data unless separately approved and configured for that purpose. (b) Installer address suggestions (Installation Packages): the names of programs installed on a managed computer are sent, and nothing else, so that the provider can suggest download addresses; a user of the customer organization starts it.
3. Customer-selected integrations and destinations
The Customer may choose to configure destinations outside the standard Telmetra service. The Customer controls whether data is sent and is responsible for its lawful configuration and relationship with the destination provider.
- Google Drive: customer-configured backup or export destination.
- Backblaze: customer-configured backup destination.
4. Data and transfer information
The data disclosed to a provider is limited to what is necessary for the relevant feature: for example, payment and invoice information for payment services, email delivery information for transactional email, or technical usage information for enabled analytics and diagnostics. Telmetra’s cookie panel is Telmetra’s own: cookie choices are kept in the browser and are not sent to a consent-management provider.
For the AI provider, every request asks that it is not stored for later retrieval. The provider states in its published API terms that it may keep requests for up to 30 days to detect abuse and that it does not use API data to train its models.
Provider processing may occur in locations relevant to the provider’s service. Locations, transfer safeguards, and contractual terms are assessed per provider and deployment; contact us for verified information relevant to your use.
5. Changes and contact
We review this register as services and configurations change. Customers with a DPA or signed agreement should use the notice and objection process in that agreement. For enquiries, contact [email protected] with the subject “Provider Register Inquiry.”