Sub-Processor List
Vulos engages the following third-party Sub-Processors to deliver the service. Per our Data Processing Agreement, we provide 30 days’ advance notice of any addition or material change. Registered account holders are notified by email at the start of each notice window.
Current authorised sub-processors
| Sub-Processor | Purpose | Data Categories | Region | Since | Status |
|---|---|---|---|---|---|
| Tigris Object Storage | Customer bucket storage and OTA artifact distribution | All customer-uploaded data and system state stored in the customer bucket. | Customer-selected (af-south / eu-west / us-east) | 01 Jan 2026 | Active |
| Fly.io | Compute hosting for the Vulos control plane (accounts, access broker, bucket provisioning). Vulos does not host customer product compute — that runs on the customer's own box. | Control-plane metadata only. | iad / lhr / fra / sjc (control plane) | 24 May 2026 | Active |
| Cloudflare DNS | DNS resolver and DDoS protection for *.vulos.org and *.vulos.cloud | DNS query metadata (IP, queried hostname). No payload content. | Global PoPs | 01 Jan 2026 | Active |
| Postmark | Transactional email delivery (verification, alerts, breach notifications) | Account email address and email content for transactional messages. | US / EU | 01 Jan 2026 | Active |
Change history
How the 30-day notice works
When Vulos intends to add a new Sub-Processor or materially change an existing one, we:
- Publish the pending change on this page with an effective date at least 30 days in the future.
- Send a notice email to the registered address of every active account at the start of the notice window.
- Allow the Controller to object by emailing privacy@vulos.org within the 30-day window. Vulos will work in good faith to resolve any objection.
- Activate the change on the effective date only after the notice window closes without unresolved objections (or with resolved ones).
The full legal mechanism is described in Section 6 of the Data Processing Agreement. For questions, email privacy@vulos.org.
Notifications
Change notices are sent to your account’s registered email address automatically. No additional subscription is required. Sign in to verify your notification address, or email privacy@vulos.org to confirm your registration.