Sub-processors
The organisations that process data on our behalf so that Restorable can run. This page is Annex 3 of the data processing agreement, and it is the authoritative list.
Your own storage provider is not on this list, and that is deliberate. You choose it, you contract with it and you pay it directly, so it is your sub-processor rather than ours. Backup content lives there, encrypted, and we hold no copy.
Current sub-processors
| Sub-processor | What it does for us | Data it can reach | Processing location |
|---|---|---|---|
| Contabo GmbH | Hosting: the virtual private server that runs the application, the workers and the database. | Everything we hold: the index, the audit log, wrapped keys, account and billing records. Not your bucket and not your passphrase. | European Union (France) |
| Postmark, part of ActiveCampaign | Transactional email: invitations, password resets, restore result emails, protection digests and billing notices. | Recipient names and email addresses, and the content of those emails, which includes tenant and client names, job outcomes and billing amounts. | United States [confirm contracting entity and transfer mechanism] |
| Stripe | Payments and invoicing: taking card and Bacs Direct Debit payments, holding payment methods, issuing invoices and the customer portal. | Billing contact name and email, billing address, VAT number, payment method and payment history. We never receive or store card or bank details. | Republic of Ireland and United States [confirm contracting entity and transfer mechanism] |
| Cloudflare | DNS for our domains, and hosting the download host at dl.restorable.cloud from which release binaries are served. | DNS queries and download request metadata, including IP addresses. No backup data and no account data. | Global network, United States entity [confirm contracting entity and transfer mechanism] |
| Microsoft | The source of the data. We read from and write to your clients' Microsoft 365 tenants through Microsoft Graph, under the consent their own administrator granted, on your instruction. | The tenant data itself, which is already Microsoft's to hold under your clients' own agreements with Microsoft. | Wherever the tenant is hosted, which your client chose [confirm how this is described in the DPA] |
Storage providers you might choose
Restorable works with any S3-compatible endpoint. MSPs commonly use Wasabi, Backblaze B2, AWS S3 or a self-hosted MinIO. Whichever you pick:
- The contract is between you and that provider, and so is the bill.
- You choose the region, which is what determines where backup content is stored and whether an international transfer is involved.
- Objects arrive already encrypted with a key specific to that client, so the provider cannot read them.
- Server-side settings such as versioning, object lock and lifecycle rules are yours to set. A lifecycle rule that expires objects will silently shorten your retention, so check it.
Changes to this list
Under clause 6 of the data processing agreement we give at least [sub-processor notice period, for example 30 days] notice by email to your account's owners before adding or replacing a sub-processor, and you may object on reasonable data protection grounds. This page is updated at the same time and remains the authoritative list.
Questions about any entry go to hello@restorable.cloud.
Last updated: [effective date].