Subprocessors

Last updated: August 4, 2026.

One Engineer uses the subprocessors below to provide, secure, bill, monitor, and support the Service. This page is a customer-data processing disclosure, not an architecture diagram or complete security control inventory. We intentionally omit internal topology, deployment details, IP ranges, image names, secret-management details, and operational vendors that do not intentionally receive customer content. Customer-configured third-party systems are not One Engineer subprocessors; they are systems you direct us to access on your behalf.

Current subprocessors

• Hetzner Online GmbH — Cloud hosting provider for the One Engineer service.
  Data categories: Customer content, account data, task data, artifacts, logs, and operational metadata needed to provide the Service.
  Processing location: European Union, with customer data transfer mechanisms where required.
• Cloudflare, Inc. — Traffic protection, DNS, and bot-prevention services for public web and account flows.
  Data categories: IP addresses, browser and request metadata, security telemetry, and limited account-flow metadata.
  Processing location: Global network.
• OpenAI, L.L.C. — AI model inference used to answer requests and operate agent workflows.
  Data categories: Prompts, task context, selected content, tool outputs, and related data sent at your direction. Production requests are configured not to train OpenAI models on customer content.
  Processing location: United States / global processing locations.
• Stripe, Inc. — Payments, subscriptions, invoices, tax calculation, billing portal, refunds, disputes, and payment fraud prevention.
  Data categories: Billing contact details, payment metadata, invoices, tax information, plan, credit, and subscription records. Payment card details are handled by Stripe, not stored by One Engineer.
  Processing location: United States / global processing locations.
• Resend, Inc. — Transactional email, including verification, recovery, invitation, billing, and operational messages.
  Data categories: Email addresses, message metadata, and email content needed to deliver the requested messages.
  Processing location: United States / global processing locations.
• Google LLC — Optional Google sign-in when a user chooses that authentication method.
  Data categories: OAuth identity data such as name, email address, and provider account identifiers.
  Processing location: Global processing locations.

Changes and objections

We will update this page when we add or materially change a subprocessor used for production customer data. Enterprise customers with a signed data-processing agreement may receive advance notice and may object to material subprocessor changes as described in that agreement.

Questions

For subprocessor questions, DPA requests, or additional security documentation, contact [email protected] or [email protected].