Sub-processors

Last updated: September 23, 2026

This page lists the third parties that process personal data on behalf of SolidPing's hosted service. It is the authoritative version of Annex III of our Data Processing Agreement.

Self-hosted SolidPing has no sub-processors: the software you run does not send data to us or to anyone else other than the endpoints you configure yourself — including the SMS and voice provider, whose credentials you supply. Everything below concerns the hosted service only.

Current sub-processors​

The Twilio row covers only the server-provided sending mode of the hosted service — the default for an organisation that has not connected its own Twilio account. An organisation that brings its own credentials sends under its own agreement with Twilio, and a self-hoster always does; in both cases Twilio is not our sub-processor. See Notification channels you configure.

Infrastructure for the marketing website​

The marketing website (www.solidping.io) is a separate surface from the hosted service. It holds no customer data, so the parties below are not sub-processors under the DPA — they process the personal data of website visitors, and we list them here for completeness.

The Google row applies to the marketing website only. That tag is not present in the dashboard, in the API, on status pages, or in self-hosted SolidPing, and it never receives account, monitoring, incident, or check data. It loads only after a visitor accepts it — before that, no request reaches Google at all. See the Cookie Policy for what it sets and how to refuse or withdraw.

Not sub-processors​

Two categories of third party regularly come up in reviews and are worth naming explicitly, because SolidPing is not their processor and does not control them.

Notification channels you configure​

When you tell SolidPing to send alerts to a Slack channel, a Discord webhook, a phone number through your own Twilio account, or any other destination, SolidPing transmits that alert to a recipient you designated. Those providers act under their own agreements with you, not with us.

This covers: Slack, Discord, Microsoft Teams (webhook and bot), Mattermost, Google Chat, Matrix, Zulip, Telegram, PagerDuty, Pushover, ntfy, Gotify, Web Push, generic webhooks, Twilio (SMS and voice, using your own credentials), web push, email addresses you enter, generic webhooks, Freebox, and Kubernetes event sinks.

Three nuances worth knowing:

• Slack and Discord apps. SolidPing operates its own Slack and Discord applications, so we hold a bot token for your workspace and receive the events your workspace sends us. What we store is set out in the Privacy Policy. The Slack and Discord platforms themselves remain your providers, not our sub-processors.
• SMS and voice have two modes, and only one of them lands here. The carve-out above applies when you supply the Twilio credentials — an organisation that has connected its own Twilio account, and every self-hosted deployment. An organisation on the hosted service that has not connected its own account is sent alerts on our credentials, under our sender identity, at our expense; there Twilio processes the recipient's number and the alert text on our instruction, and it is a sub-processor, listed in the table above. Your organisation's effective mode is shown on its Integrations page.
• Email delivery. Transactional email — sign-in links, verification codes, incident notifications, status-page subscriber mail — is sent through an SMTP provider. Where that provider is a third party rather than our own infrastructure, it is added to the table above before any customer data flows through it.

Identity providers you sign in with​

Signing in with Slack, Discord, Google, GitHub, GitLab, Microsoft, your own LDAP directory, or your own OIDC provider means that provider gives us your identity. Data flows from them to us. They are independent controllers of their own platforms, not our sub-processors.

International transfers​

Your account data, your monitoring history, and every backup stay in France. The database never leaves OVHcloud in Gravelines. Three categories of transfer outside the EEA can nonetheless occur:

1. Check workers in non-EU regions. A check that runs from a non-EU region is executed by a worker in that region, which receives the check definition and returns its result. Today that means our US worker at IONOS, plus Fly.io agents in whichever regions you select (Tokyo, São Paulo, Sydney, Ashburn, and so on). Check definitions can contain personal data if you put it there — a hostname, a URL path, a check name — so these count as transfers. They rely on the EU SCCs. You control which regions you use: restrict your checks to EU regions and no monitoring data leaves the EEA.
2. Sub-processor support access. US-headquartered providers with EU infrastructure (PostHog, Sentry) may access EU-stored data from the US for support. These transfers rely on the EU SCCs, supplemented by encryption in transit and the data-minimisation measures described in Security measures.
3. SMS and voice alerts sent on our credentials. Where the hosted service sends on its own Twilio account, the recipient's phone number and the alert text are processed by Twilio Inc. in the United States and then handed to the recipient's mobile network, wherever that is. This transfer relies on the EU SCCs. It does not arise for an organisation using its own Twilio credentials, nor for a self-hosted deployment.

Where a provider is certified under the EU–US Data Privacy Framework, that adequacy decision applies in addition to the SCCs.

How we notify you of changes​

Before adding or replacing a sub-processor, we give at least 30 days' notice:

• this page is updated, with a new "Last updated" date; and
• an email is sent to the administrative contacts on every affected account.

You may object on reasonable, documented data-protection grounds within those 30 days. The process, including your right to terminate without penalty if the objection cannot be resolved, is in DPA clause 6.

Open notice period. The Twilio entry was notified on August 19, 2026, so the 30-day objection period for it runs to September 18, 2026. If you would rather not have SMS and voice sent on our credentials, connect your organisation's own Twilio account on its Integrations page — that moves the sending back under your own agreement with Twilio, with no sub-processor on our side.

To be added to the notification list without holding an account — for example as a prospective customer running a vendor assessment — email contact@solidping.io.

Change history​