Subprocessors
Last updated: August 5, 2026
This page lists the subprocessors Candor Host uses to deliver its hosting service. Under the GDPR, subprocessors are third parties that process personal data on our behalf. Each is bound by a written contract with data protection obligations no less protective than those in our Data Processing Agreement.
We update this list when subprocessors are added or removed. Material changes are communicated to customers by email or through the client portal at least 30 days in advance.
Current subprocessors
| Subprocessor | Purpose | Location | Data types |
|---|---|---|---|
| Stripe, Inc. | Payment processing for subscription billing. | United States (Stripe operates globally with EU/UK subsidiaries). | Customer name, billing address, email, payment card details, transaction records. |
| Cloudflare, Inc. | DDoS mitigation, DNS caching, and edge CDN, at customer’s option. | Global anycast network with data centers in multiple regions. | IP addresses, HTTP request metadata. |
| Contabo GmbH | Backup storage (off-site copies). | Germany. | Encrypted backup archives of hosted content. |
| Amazon Web Services, Inc. | Cold-storage backups and transactional email relay when explicitly configured by customer. | United States (US East region). | Encrypted backup archives; email metadata for outbound transactional email. |
| OVHcloud US, LLC | Compute infrastructure for VPS and dedicated-server products — the instances that run customer workloads — and for the Candor Deploy control plane: the platform database, client portal, and build orchestration. | United States (US-East, Virginia; US-West, Oregon). | All content and data the customer stores on their VPS or dedicated server. For Candor Deploy: account and project records, service configuration, environment variables, build logs and metadata. |
| OVH Hosting, Inc. | Compute infrastructure for Candor Deploy application workloads — the node that runs customer apps, background workers, and managed databases. | Canada (Beauharnois, Quebec). | All content and data a customer’s Candor Deploy apps process or store, including the contents of managed Postgres, MySQL, and Redis instances. |
| The Constant Company, LLC (Vultr) | Compute infrastructure for VPS instances in additional US regions, when provisioned there. | United States (multiple regions). | All content and data the customer stores on their VPS. |
We use no third-party website analytics, so no subprocessor receives data about visitors to candorhost.com. The self-hosted analytics we plan to add will run on our own infrastructure and will not change this. See our Analytics Transparency page for details on what we collect from visitors to candorhost.com.
Data center and network operator
Our managed WordPress hosting runs on hardware we operate directly at a colocation facility. Our VPS, dedicated-server, and Candor Deploy products are provisioned on compute infrastructure operated by the providers named above (OVHcloud, and Vultr in some regions); on those products the provider supplies the physical facility, power, network, and virtualization layer, and the customer’s data lives on that infrastructure. In every case the provider is bound by the subprocessor terms described on this page.
Candor Deploy runs on two machines in two countries, and we would rather say so plainly than round it off: the control plane — the platform database, the client portal, and the build system — is in Virginia, and the node that actually runs customer applications and their managed databases is in Quebec, Canada. If your app or its data must stay inside the United States, Candor Deploy is not the right product for you today; email legal@candorhost.com and we will tell you where that stands rather than guess.
| Facility | Location | Role |
|---|---|---|
| Vint Hill, Virginia colocation | Vint Hill, VA, United States. | Physical facility, power, network connectivity for web1 (managed WordPress hosting). No access to customer data. |
| OVHcloud US data centers | Virginia & Oregon, United States. | Compute, facility, power, and network for VPS and dedicated-server products, and for the Candor Deploy control plane. |
| OVHcloud Beauharnois (BHS) | Beauharnois, Quebec, Canada. | Compute, facility, power, and network for Candor Deploy application workloads and managed databases. |
Objection process
Under Section 6 of our Data Processing Agreement, customers may object to a new subprocessor within 30 days of notification. If we cannot accommodate the objection, the customer may terminate the affected service and receive a pro-rata refund.
Send objections to legal@candorhost.com.
What each subprocessor can and can’t do
Every subprocessor is contractually restricted to processing customer data solely for the purpose of providing services to Candor Host. No subprocessor is permitted to:
- Sell or share customer data with third parties.
- Use customer data for advertising or profiling.
- Transfer customer data to jurisdictions without adequate data protection safeguards.
- Retain customer data beyond the period necessary to provide services.
We conduct written data protection due diligence on subprocessors before onboarding them and periodically review their compliance.
International transfers
Subprocessors located outside the European Economic Area, United Kingdom, or Switzerland are engaged under the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or an equivalent transfer mechanism.
For the Canadian infrastructure used by Candor Deploy, transfers additionally rely on the European Commission’s adequacy decision for Canada (Commission Decision 2002/2/EC), which covers recipients subject to Canada’s Personal Information Protection and Electronic Documents Act.
Historical subprocessors
We maintain a record of subprocessors previously used but no longer engaged. This list is available on request under the audit provisions of our DPA.
Contact
Questions about our subprocessor list or objections to a specific subprocessor: legal@candorhost.com.