Every vendor that processes customer data on olladns's behalf. We'll give you 30 days' notice before adding a new one — subscribe via the email on this page.
| Subprocessor | Purpose | Data type | Location | DPA |
|---|---|---|---|---|
| Cloudflare, Inc. | Marketing-site CDN + DNS hosting for olladns.com zone | Edge access logs (no customer DNS query content) | Global edge | link |
| Stripe, Inc. | Payment processing for self-serve plans | Billing email, card token (we never see card numbers) | USA | link |
| Postmark / ActiveCampaign | Transactional email (login codes, billing receipts, security alerts) | Email address, message content | USA | link |
| (Hosting provider — name on request) | Compute, storage, and network for the resolver + control plane | All customer data (DNS queries, tenant config, audit logs, account data) | USA (Mumbai region in progress) | BAA-style DPA, available on request to enterprise customers under NDA |
| Let's Encrypt (ISRG) | TLS certificate issuance for *.olladns.com via ACME DNS-01 | Public DNS records only (no customer data) | USA | No customer data processed; policy |
| Anthropic, Inc. | MCP server protocol partner — relays MCP requests from Claude clients to mcp.olladns.com | None — your X-API-Key flows directly to our service; Anthropic does not see customer DNS data | USA | No data shared by olladns; customer's own agreement with Anthropic applies to their Claude usage |
To save you from asking: we do not run customer data through any analytics SDK (Mixpanel, Segment, Amplitude, Pendo, FullStory, Hotjar, Posthog), CRM enrichment service (Clearbit, ZoomInfo), advertising platform (Google, Meta, LinkedIn pixels), or data broker. We are not on Google Tag Manager. We do not use ML model training APIs on customer DNS data.
When we add, remove, or change a subprocessor, we'll email everyone subscribed to [email protected] at least 30 days before the change takes effect. You can object to a change via that address; if we can't move forward without the new subprocessor and you don't accept, we'll let you terminate without penalty and refund prepaid time.
Several of our subprocessors use their own subprocessors (e.g. Cloudflare uses AWS for some functions; Stripe uses many regional acquirers). We rely on their respective DPAs and notification practices for those sub-tiers rather than reproducing them here. If you need a specific sub-subprocessor inventory for compliance purposes, email [email protected].
Our DPA (Standard Contractual Clauses for EU transfers, GDPR Art. 28 obligations, DPDP §11 obligations) is countersigned in your order form for enterprise plans, or auto-included when you accept the Terms of Service on self-serve plans. A standalone signed DPA is available for free on request from [email protected].