Sub-processors
Last updated: 5 October 2026
This list is also available in Romanian.
It names every company that handles personal data for InfraInbox, which is run by INNOVA SOFTWARE S.R.L. (Romania, CUI 45402130, J30/1284/2021). Our Data Processing Agreement (clause 5) refers to it.
Changes: we email every Cloud workspace owner at least 30 days before a new sub-processor starts handling customer data, and record each change in the change log below.
Self-hosted InfraInbox uses none of these companies, except our push relay (section C) and Apple’s push service if you use the iPhone app.
A. Sub-processors for InfraInbox Cloud
They process data on our behalf, under a written contract that meets Art. 28 GDPR.
| Company | What they do for us | Where the data is | Transfer basis |
|---|---|---|---|
| IFAS Consult SRL, trading as DanubeData (Romania) | Hosting: the Cloud servers, database, push relay and daily backups | Germany (Falkenstein) | None needed: EEA |
| ↳ Hetzner Online GmbH (Germany), DanubeData’s sub-processor | Data centre, physical servers, network | Germany | None needed: EEA |
| Scaleway SAS (France) | Sending account emails: address confirmation, password resets, invitations, service notices | France | None needed: EEA |
B. Others that receive data under their own terms
They are not our processors: each runs its own service and decides how. We list them so you can see every company that receives personal data through InfraInbox.
| Company | When | What they receive | Where | Transfer basis |
|---|---|---|---|---|
| Apple Inc., Apple Push Notification service | You allow notifications through Apple in the iPhone app (Cloud or self-hosted) | An encrypted envelope only your phone can open, the phone’s push token, our relay’s IP address, the time and size of each notification | United States | Your explicit consent in the app (Art. 49(1)(a) GDPR). Apple is not certified under the EU–US Data Privacy Framework and offers no standard contractual clauses for this service |
| Google LLC | You choose “Sign in with Google” | The sign-in exchange: account identifier, email address, name | United States | EU–US Data Privacy Framework (Art. 45 GDPR) |
| GitHub, Inc. | You choose “Sign in with GitHub”, or report a vulnerability through GitHub | The sign-in exchange, or your report | United States | EU–US Data Privacy Framework (Art. 45 GDPR) |
C. Our own infrastructure
| Service | Run by | Where | What it handles |
|---|---|---|---|
InfraInbox push relay (push.infrainbox.app) |
INNOVA SOFTWARE S.R.L. | Germany, on DanubeData | Phone registrations, and encrypted notifications on their way to Apple. It cannot read their content (Privacy Policy §5) |
D. Messages you send us
| Company | What | Where |
|---|---|---|
| Zoho Corporation B.V. (Netherlands), Zoho Mail | Hosts our company mailbox, which receives the messages you send us | EU data centres (Netherlands, Ireland). Zoho’s data processing addendum governs any access by Zoho group companies outside the EEA |
Not used
- No analytics, crash-reporting, advertising or external monitoring service receives data from InfraInbox Cloud, the website or the iPhone app.
- No payment provider: Cloud is free during the beta.
- Firebase / Google push (FCM): not used until an Android app ships.
- Cloudflare answers DNS queries for our domains only. No traffic to the website, the dashboard or the relay passes through it.
Change log
| Date | Change |
|---|---|
| 5 October 2026 | First published list |