Last updated: 2026-07-30
A "sub-processor" is a third party that processes data to help us deliver the Vatnode service. We keep this list current and give notice of material changes so customers can object. The validation path is hosted in Germany (EU), and no validation personal data leaves the EEA.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting & infrastructure (the server and database run here) | All stored validation data (see below) | Germany · EU |
| European Commission — VIES | The official EU VAT validation source; issues the consultation number | VAT number, requester VAT number | EU |
| National business registers — Brønnøysund (NO), SIRENE / recherche-entreprises (FR), MF White List (PL), PRH (FI), ARES (CZ), CVR (DK) | Non-VIES validation & VIES-outage fallback | VAT / business number | EU/EEA (public authorities) |
| Polar Software Inc. | Payments (Merchant of Record) — billing & EU VAT on the subscription only | Billing data. No validation data. | EU VAT handled (MoR) |
| Porkbun | Transactional / account email | Email address | — |
Vatnode stores only: api_key, the VAT number validated, requester VAT number, validity result, the VIES consultation number, request date and timestamp. We store no invoice contents, amounts, orders, cardholder data, or general accounting/ERP data.
Requesting a DPA, our current sub-processor list, or objecting to a change? Email oscar@vatnode.com. See also our Privacy Policy and Terms.