Sub-processors

About this list

These providers process personal data for GoRunner Cloud under the Data Processing Agreement, each under a data processing agreement with us. We tell each organization’s owners at least 30 days before we add or replace one, and they may object (DPA § 7). A self-hosted installation uses none of them.

Amazon Web Services

• What for: Hosting of GoRunner Cloud: servers, database, object storage and backups.
• Data: All GoRunner Cloud data.
• Where: Frankfurt, Germany (eu-central-1). Amazon Web Services EMEA SARL, Luxembourg; parent in the USA.
• Safeguard: Data stays in the EU. EU-US Data Privacy Framework and Standard Contractual Clauses for any access from the USA.

Cloudflare

• What for: DNS for gorunner.io, and delivery and protection of gorunner.io, docs.gorunner.io and the dashboard’s files at app.gorunner.io. API traffic (api.gorunner.io) does not pass through Cloudflare.
• Data: Visitors’ IP addresses, browser user agents and the addresses of the pages asked for.
• Where: Cloudflare’s global network. Cloudflare, Inc., USA.
• Safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses.

Resend

• What for: Sending service emails: sign-in links and codes, and invitations.
• Data: Recipients’ email addresses and the messages, including the organization’s name and the inviter’s name in an invitation.
• Where: USA; mail is sent through Amazon SES in Ireland (eu-west-1).
• Safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses.

Grafana Labs

• What for: Monitoring: logs, metrics and traces of the servers.
• Data: IDs of organizations, workspaces, workflows, runs and steps; workflow and step names; error messages, which can quote run data such as an email address; dashboard error reports with the browser’s family. No client IP addresses; secrets removed.
• Where: Grafana Cloud region prod-eu-west-2, on AWS in Germany. Raintank, Inc. dba Grafana Labs, USA.
• Safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses.

Google

• What for: Google Workspace: our mailboxes (support@, privacy@, security@ and our other @gorunner.io addresses). And, only when you connect a Google account with GoRunner’s own Google sign-in, Google’s sign-in for that connection.
• Data: What you write to us. For a Google connection: that you agree to give GoRunner access.
• Where: Ireland and the USA. Google Cloud EMEA Limited, Ireland; parent Google LLC, USA.
• Safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses.

Not our sub-processors

• AI providers. Keel uses the AI provider your organization connects, with your organization’s own account and key. That provider works under your contract with it, not ours. GoRunner Cloud has no AI provider of its own.
• The apps your workflows connect to. Your organization chooses them and sends them data through its own connections.

Changes

• 2 November 2026: First published list.