Third parties we use for the website, licensing, checkout and support.
This list covers account.getskarn.com (the licensing/billing portal), the license service API, getskarn.com itself, our company email, our customer relationship system and the support telephone number. It does not cover the offline scan itself: skarn check, skarn assess, and every other command run on your machine with no third party in the path, except the two commands that make an explicit outbound call on their own - skarn license renew, which by default reaches our licensing service on Cloudflare, listed below, and skarn check --update-rules, which reaches only the feed URL you configure. Both destinations are configurable ($SKARN_LICENSE_RENEW_URL and --feed-url), for example for a customer's own proxy or self-hosted setup - whoever operates a destination you configure receives that request, and it is outside the scope of this list. See the telemetry statement for the exact list.
Every party below acts on our instructions as our processor, except Paddle, which sells in its own name as merchant of record and is an independent controller for billing data, and Cloudflare for the Turnstile signals it also uses, as a controller, to improve its bot detection. We update this list when a party is added or removed and change the date below. The privacy policy says what we collect and why.
Last updated 2026-09-24.
| Third party | Role and purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Processor. Hosting for getskarn.com and account.getskarn.com (Workers), the licensing database (D1), its daily backups (R2), the signing of free licenses, DNS, the Turnstile challenge on the registration form, and the edge firewall in front of all of it. Independent controller of the Turnstile signals (such as the IP address and browser header) it uses to improve its bot detection. | All portal, registration and licensing data in transit and at rest: account, member, seat, invitation, order, invoice and audit records, and the keyed hash of a registration's IP address. The edge sees the IP address of every request it serves. By design, the license service holds no scan or session content. | Cloudflare's global network. D1 and R2 support an EU jurisdiction/location hint; DNS resolution and Workers compute route to Cloudflare's nearest edge location by design and are not region-locked. We do not represent this as EU data residency. |
| Amazon Web Services | Processor. Holds the key that signs paid licenses (AWS KMS) and computes each signature, and stores our weekly backups (Amazon S3). | The contents of each paid license being signed: the holder's email address or account name, the organization name, tier, seat count and dates. The weekly backups hold the whole licensing database, including account, member, order and audit records, encrypted at rest. | Frankfurt, Germany (eu-central-1). |
| GitHub | Processor. Runs the weekly job that exports the licensing database and audit log before the export is stored at Amazon Web Services. | The export, for the duration of the job. | GitHub-hosted runners, not pinned to a region. |
| Paddle.com Market Limited | Independent controller, as merchant of record for Pro and Team subscriptions: sells the license in its own name and runs checkout, invoicing, tax handling and payment processing. | Billing and payment data, including card details, collected by Paddle at checkout. Paddle does not send us full card numbers. Paddle passes us the buyer's name and email address, a customer reference, the order, subscription, invoice and payment references and amounts, and limited card details such as the last four digits. | A United Kingdom company on Paddle's own infrastructure; Paddle's privacy notice names the parties it uses. |
| SMTP2GO | Processor. Transactional email delivery: magic-link sign-in, registration confirmation, license issuance notices, invitation emails, account notifications, and the scheduled reports our analytics server sends to us. | Recipient email address and message content, which includes names, organization details and sign-in, confirmation or invitation links. By design, no email carries a license token or a scan finding. | EU infrastructure (eu-api.smtp2go.com, mail-eu.smtp2go.com). SMTP2GO is a New Zealand company. |
| Hetzner Online GmbH | Processor. Rents us the server that runs our self-hosted Matomo analytics, its database and its daily database dumps. | Website visit data with the last two bytes of the IP address discarded, no cookies and no account identifier, including visits to the registration and checkout pages; for each registration, a conversion event that carries the campaign parameters and no name or email address; and aggregated statistics. The portal database and the checkout data are not stored there. | Nuremberg, Germany. |
| HubSpot Ireland Ltd | Processor. Our customer relationship system: the record of who we talk to about a purchase. | Names, work email addresses, companies and the emails we choose to log for prospective and existing customers. Nothing enters HubSpot from the portal, the registration form or the checkout: contacts are entered by hand, imported, or logged from a one-to-one email. HubSpot's AI and enrichment features are switched off. | European Union (Germany). |
| Microsoft | Processor. Microsoft 365 (Exchange Online) hosts our company email: everything you send to hello@, security@ or office@getskarn.com, our replies, and the voicemail messages from the support number. | Your email address, the content of your messages and attachments, and, for a voicemail, your phone number and the recording. | European Union and EFTA (the tenant's data location). |
| Zadarma | Processor. Runs the support number +372 699 1426: every call goes to voicemail, and the recording and the caller's number are emailed to hello@getskarn.com. Live call recording is off. | The caller's phone number, the call time and the voicemail recording. | Zadarma states that it processes personal data in databases located in the European Union; its privacy policy names the entities it uses. |
What's never on this list
By design, nothing here receives AI coding-session content, scan findings, or secrets from the scanner - the license service is scoped to licensing, identity, and billing records, and the scan itself runs on your machine with no third party in the path. What you choose to email us is handled as the Microsoft row describes. See the telemetry statement for the list of what the binary sends and to whom.