Subprocessors
Last Updated: December 10, 2025
Overview
This page lists all third-party service providers (sub-processors) that AriseNote uses to process customer data when providing the AriseNote service. We are committed to transparency about who has access to your data and why.
As required by our Data Processing Agreement (DPA), we provide at least 30 days' advance notice before adding new sub-processors or making material changes to existing ones.
Current Subprocessors
1. Hetzner Online GmbH
Service: Infrastructure hosting (servers, databases, self-hosted analytics)
What data is processed:
- All customer account data
- Widget configurations and settings
- Cached database contents (temporary, < 24 hours)
- Application databases and files
Purpose: Primary hosting infrastructure for AriseNote application and data storage
Location:
- EU Users: Hetzner data centers in Falkenstein and Nuremberg, Germany
- US Users: Hetzner data centers in United States (Ashburn, Virginia and Hillsboro, Oregon)
Data transfer mechanism: Data stored within EU for EU users; no transfer outside EEA required
Hetzner information:
- Website: https://www.hetzner.com
- Privacy Policy: https://www.hetzner.com/legal/privacy-policy
- Certifications: ISO 27001, ISO 9001
- Location: Germany (EU)
2. Amazon Web Services, Inc. (AWS)
Service: Cloud file storage (S3)
What data is processed:
- User-uploaded profile avatars
- Image files
Purpose: Storing and serving user profile images
Location: AWS S3 in us-east-1 region (United States)
Data transfer mechanism: EU Standard Contractual Clauses (SCCs) for transfers from EEA; UK IDTA for transfers from UK
AWS information:
- Website: https://aws.amazon.com
- Privacy Policy: https://aws.amazon.com/privacy/
- Certifications: ISO 27001, SOC 1/2/3, PCI DSS Level 1
- GDPR Compliance: https://aws.amazon.com/compliance/gdpr-center/
3. Stripe, Inc.
Service: Payment processing
What data is processed:
- Billing information
- Credit card details (tokenized)
- Customer email address
- Transaction records
- Last 4 digits of credit card
- Card expiration date
Purpose: Processing subscription payments and managing billing
Location: United States
Data transfer mechanism: EU Standard Contractual Clauses (SCCs); UK IDTA for UK transfers
Important notes:
- Stripe directly handles sensitive payment information
- AriseNote does not store full credit card numbers
- Stripe is PCI DSS Level 1 certified
Stripe information:
- Website: https://stripe.com
- Privacy Policy: https://stripe.com/privacy
- Certifications: PCI DSS Level 1, ISO 27001, SOC 1 & SOC 2
- GDPR Compliance: https://stripe.com/guides/general-data-protection-regulation
4. Mailgun Technologies, Inc. (Sinch)
Service: Transactional email delivery from AriseNote domain
What data is processed:
- Email addresses
- Customer names
- Email message content (account notifications, password resets, etc.)
Purpose: Delivering transactional and service-related emails from our own domain
Location: United States
Data transfer mechanism: EU Standard Contractual Clauses (SCCs); UK IDTA for UK transfers
Important notes:
- Used only for transactional emails (account notifications, password resets, billing confirmations)
- Not used for marketing emails unless you opt in
- Mailgun does not permanently store email content
Mailgun information:
- Website: https://www.mailgun.com
- Privacy Policy: https://www.mailgun.com/legal/privacy-policy/
- Parent Company: Sinch
- GDPR Compliance: GDPR-compliant data processing
5. Notion Labs, Inc.
Service: API integration for accessing Notion databases
What data is processed:
- Notion workspace information
- Access tokens for connected databases
- Database contents that you grant AriseNote access to
- User information from Notion (name, email, avatar)
Purpose: Accessing your Notion databases to display widgets (core functionality)
Location: United States
Data transfer mechanism: EU Standard Contractual Clauses (SCCs); UK IDTA for UK transfers
Important notes:
- You control which databases AriseNote can access through Notion's permission system
- AriseNote reads database contents in real-time but does not permanently store them
- Data is temporarily cached for performance (< 24 hours)
- You can revoke access at any time through Notion settings
Notion information:
- Website: https://www.notion.so
- Privacy Policy: https://www.notion.so/Privacy-Policy
- Security: https://www.notion.so/security
- Certifications: SOC 2 Type II, ISO 27001
Data Processing Safeguards
For all sub-processors located outside the European Economic Area (EEA) or United Kingdom, AriseNote ensures appropriate safeguards through:
Legal Mechanisms
- Standard Contractual Clauses (SCCs): EU Commission-approved clauses for data transfers to third countries
- UK International Data Transfer Addendum (UK IDTA): For transfers from the United Kingdom
- Data Processing Agreements: All sub-processors sign DPAs with security and confidentiality obligations
Technical Safeguards
- Encryption in Transit: All data transfers use TLS 1.3 encryption
- Encryption at Rest: Data stored by sub-processors is encrypted
- Access Controls: Strong authentication and authorization mechanisms
- Regular Audits: Sub-processors undergo regular security audits
- Monitoring: Continuous monitoring for security incidents
Contractual Requirements
All sub-processors must:
- Implement appropriate technical and organizational security measures
- Process data only for specified purposes
- Not use data for their own purposes (e.g., advertising, AI training)
- Maintain confidentiality
- Assist with data subject rights requests
- Notify AriseNote of security incidents
- Delete data when no longer needed
- Cooperate with audits and inspections
Sub-processor Updates
How We Notify You
When we add a new sub-processor or make material changes to an existing one, we will:
- Send email notification to your account email address at least 30 days in advance
- Update this page with the new information
- Post announcement on our status page at https://status.arisenote.com/status/arisenote
Your Right to Object
If you have legitimate data protection concerns about a new sub-processor, you may:
- Object in writing within 15 days of notification
- Provide specific reasons related to data protection
- Work with us to find a resolution
If we cannot resolve your concerns within 30 days, you may:
- Terminate your subscription and receive a pro-rata refund
- Export your data before termination
For more details, see Section 4.4 of our Data Processing Agreement.
Regional Data Storage
AriseNote uses geographic routing to store your data close to you:
EU/EEA Users
- Primary storage: Hetzner servers in Germany (EU)
- File storage: AWS S3 in United States (profile avatars only)
- Your Notion data: Read in real-time from Notion (US), temporarily cached in EU
US Users
- Primary storage: Hetzner servers in United States
- File storage: AWS S3 in United States
- Your Notion data: Read in real-time from Notion (US), temporarily cached in US
Other Regions
- Routed to nearest server (EU or US) based on geographic location
- You can contact us to confirm your data storage location
Third-Party Certifications
Our sub-processors maintain industry-standard security certifications:
| Sub-processor | Certifications |
|---|---|
| Hetzner | ISO 27001, ISO 9001 |
| AWS | ISO 27001, SOC 1/2/3, PCI DSS Level 1 |
| Stripe | PCI DSS Level 1, ISO 27001, SOC 1 & SOC 2 |
| Mailgun | GDPR-compliant processing |
| Notion | SOC 2 Type II, ISO 27001 |
Questions or Concerns?
If you have questions about our sub-processors or data processing practices:
Email: help@arisenote.com
Review our related documents:
- Data Processing Agreement - Complete details on data processing
- Privacy Policy - How we handle your personal information
- Terms of Service - Our complete terms and conditions
Change History
| Date | Change |
|---|---|
| December 10, 2025 | Initial publication of subprocessors list |
Last reviewed: December 10, 2025
Next review: March 10, 2026