Transparency

List of
Subprocessors

Bunker uses a limited number of subprocessors to deliver its services. The vast majority of our infrastructure is self-hosted in France.

Subprocessors

Subprocessor Country Purpose Data processed DPA
Stripe (Stripe Inc.) USA (SCCs) Payment processing Billing data, payment tokens Yes
Cloudflare (Cloudflare Inc.) USA (SCCs) DNS and DDoS protection Visitor IP addresses, HTTP requests Yes
BetterStack (Better Stack Ltd) EU (Lithuania) Uptime monitoring Public URLs, response times Yes

A European alternative to Cloudflare is being evaluated.

Self-hosted services in France

The following services are operated by Bunker in its own datacenters in France. They are not subprocessors.

Keycloak

Authentication and identity management

PostgreSQL

Databases

Redis

Cache and message queues

Matomo

Web analytics (CNIL exemption)

GitLab

CI/CD and code management

Grafana / Loki / Tempo / Mimir

Observability and monitoring

Ceph S3

Object storage

DocuSeal

Electronic signatures

N8N

Workflow automation

CrowdSec

WAF and security protection

Headscale

WireGuard VPN

Update policy

We notify our clients by email at least 30 days before adding any new subprocessor. You may object to the addition of a new subprocessor under the terms of your contract.

Last updated: February 2026

Questions about our subprocessors?

Contact our DPO at [email protected]

Contact us