Sub-processors
Contents
5 sections, 0 numbered clauses
Contents
Last updated 14 September 2026
Version 1, effective September 14, 2026
About this page
This page lists the third-party sub-processors Kapsule Group Limited ("KapsuleHost") currently engages to process personal information on behalf of our customers. It is maintained in accordance with clause 5 of the Data Processing Agreement.
We will notify you of any addition or material change to this list at least thirty (30) days before the new sub-processor begins processing. Notification is automatic, by email to your account address, and by update to this page; you do not need to request it.
If you object to a new sub-processor on reasonable grounds, email privacy@kapsulehost.com before the date given in that notice. See clause 5.4 of the Data Processing Agreement for what happens next.
Current sub-processors
| Sub-processor | Purpose | Primary location |
|---|---|---|
| Hetzner Online GmbH | Server infrastructure: all customer sites, databases, and email are hosted on Hetzner dedicated and cloud servers | EU, US, Asia-Pacific |
| Cloudflare, Inc. | R2 object storage for encrypted off-site backups, stored in the Oceania region | United States |
| BunnyWay d.o.o. | Content delivery network (CDN), edge caching, and DDoS protection for customer sites and the marketing site | Slovenia (EU) |
| Stripe, Inc. | Payment processing and subscription billing | United States |
| Openprovider B.V. | Domain registration, renewal, and DNS management | Netherlands (EU) |
| Stalwart Mail Server (self-hosted) | Customer email hosting: IMAP, SMTP, and webmail for customer mailboxes (operated on Hetzner infrastructure) | EU |
| Resend, Inc. | Transactional outbound email: account notifications, billing emails, password resets, and other service emails | United States |
| Anthropic, PBC | Large language model API powering Kora, our AI customer-support assistant | United States |
| Sentry (Functional Software, Inc.) | Error tracking and application performance monitoring | United States |
| GitHub (Microsoft Corporation) | Source code hosting and automated daily backups of the KapsuleHost platform codebase; OAuth sign-in ("Sign in with GitHub"); and repository access for Orbit deployments, where GitHub receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| Apple Inc. | Authentication email relay via Apple Private Relay, for customers who use "Sign in with Apple" to access KPanel | United States |
| Google LLC | OAuth sign-in ("Sign in with Google") for customers who authenticate to KPanel with a Google account, and PageSpeed Insights performance checks, which send Google the address of the site being checked | United States |
| Discord Inc. | OAuth sign-in ("Continue with Discord") for customers who create or access a KPanel account with a Discord account; Discord returns the account id, username, and verified email address | United States |
| Twilio Inc. | Delivery of one-time verification codes by SMS and WhatsApp for two-factor authentication and account verification; Twilio receives the mobile number you provide for that purpose | United States |
| Intuition Machines, Inc. (hCaptcha) | Bot and abuse defence on sign-up and checkout; hCaptcha receives your IP address and browser interaction signals when a challenge is presented | United States |
| Better Stack, Inc. | Synthetic uptime monitoring of customer websites from multiple regions; the monitor carries the site address and its account identifier | United States |
| Atlassian, Inc. (Bitbucket) | Repository access for Orbit deployments, for customers who connect a Bitbucket account; Atlassian receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| fal (Features & Labels Inc.) | Image generation and image editing in Kapsule Agents; receives the prompt you write and any source image you supply | United States |
| Tillify | Payment initiation for New Zealand customers who pay an invoice by direct bank transfer | New Zealand |
Changes to this list taking effect
The entries below are being added to this list, or their description updated. Some of them already process customer personal information for the purpose shown: this list was incomplete, and it is being corrected with the notice that clause 5.3 of the Data Processing Agreement requires. Each entry forms part of the list above from the date given in that notice.
These entries take effect thirty (30) days after we notify customers by email. That notice has not been sent yet; this page will show its date once it has.
| Sub-processor | Purpose | Primary location |
|---|---|---|
| PayPal Pte. Ltd. | Payment processing for customers who choose to pay with PayPal at checkout; PayPal receives the payer's name, email address and the amount | Singapore (processing in the United States and other countries) |
| Sampark, Inc. (Composio) | Connection of third-party app accounts to Kapsule Agents; Composio stores the authorisation you grant each connected app and relays the requests an agent makes to it | United States |
| Telegram Messenger Inc. | Delivery of support conversations with Kora for customers who contact us through Telegram | Outside the EEA; Telegram does not publish the jurisdiction of this entity (its group companies are in the British Virgin Islands and Dubai, United Arab Emirates) |
| Moonshot AI Pte. Ltd. | Large language model API powering Kapsule Agents; receives the instructions and content you give an agent | Singapore |
| GitLab Inc. | Repository access for Orbit deployments, for customers who connect a GitLab account; GitLab receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| Mem0 | AI conversation memory | United States |
| Langfuse GmbH | AI observability | European Union |
| Cloudflare, Inc. | R2 object storage, which holds: encrypted off-site backups of customer sites, databases, email and managed servers, stored in the Oceania region; encrypted backups of our own platform databases and file store; the site backups you create in KPanel, and database logs for point-in-time recovery; files you upload when you migrate a site to us, and files uploaded to KPanel and the Sites builder; the account data exports you request; archived server logs; and, for Orbit, your project source code, build output and build logs, and the objects you store. Also Turnstile bot checks on reseller sign-up, which receive the visitor's IP address | United States |
| Google LLC | OAuth sign-in ("Sign in with Google") for customers who authenticate to KPanel with a Google account, and PageSpeed Insights performance checks, which send Google the address of the site being checked; address suggestions at checkout, which send Google the address you type; and web fonts on some pages, which Google serves to your browser | United States |
International transfers
Some sub-processors are located outside New Zealand. Where personal information is transferred internationally, we ensure comparable safeguards apply as described in clause 9 of the Data Processing Agreement and clause 7 of the Privacy Policy.
Sub-processors in the European Union or Switzerland are subject to the GDPR or a comparable privacy framework. Sub-processors in the United States are subject to contractual safeguards, including by reference to Standard Contractual Clauses where appropriate.
Changes to this list
We will update this page when sub-processors are added, removed, or their details change materially. We will notify customers by email at least thirty (30) days before a new sub-processor begins processing Customer Personal Information, or a material change to an existing sub-processor takes effect, as set out in clause 5.3 of the Data Processing Agreement.
If you have concerns about a sub-processor, please email privacy@kapsulehost.com.
Eleven documents, and none of them is behind a login.
Every one is indexed, searchable by word, and deep linkable by clause. Six of them are not in the footer and this is how you reach them.