Trust & governance
Sub-processors
"European-hosted" should be something you can check, not just read. This is the full list of third parties that process data for Untamed Data — what each one does, where the data physically sits, the entity behind it, and the safeguard for any transfer.
A sub-processor is a service we rely on that may handle data on our behalf. We keep the list short and European-first by design: the platform, its database, its storage, and the AI all run on servers in the Netherlands. The five providers in the table below process data on our behalf. Below it, for completeness, we also list the services that are not processors.
Where the AI runs. The species recognition that labels your footage runs on our own hardware, not a cloud AI service. As of August 2026, no images are sent to any external AI service for it, so no third party receives your footage to label it.
| Provider | What it processes | Where data is stored | Provider HQ | Transfer safeguard |
|---|---|---|---|---|
| VIMEXX B.V. (team.blue) | The core platform: app, database, object storage, FTP upload, and species recognition | Netherlands | Netherlands | No third-country transfer (EU) |
| Backblaze | Nightly encrypted backup of the database and media | Amsterdam (EU Central) | United States | EU Data Privacy Framework, with Standard Contractual Clauses |
| Migadu-Mail GmbH | Email for untameddata.com addresses — sending (sign-in links, digests, notifications) and receiving (mail sent to the domain) | France | Switzerland | Switzerland adequacy decision |
| Functional Software, Inc. (Sentry) | Error reporting (no request tracing; personal data stripped) | Germany | United States | EU Data Privacy Framework (Standard Contractual Clauses as fallback) |
| Cloudflare, Inc. | DNS, and hosting for this marketing site | United States | United States | Standard Contractual Clauses (with UK addendum) and the EU Data Privacy Framework |
Two details worth stating plainly:
- Hosting is one provider, not three. Our host, VIMEXX B.V. (KvK 70570078, Leiden), is part of team.blue and runs on infrastructure of its sister company TransIP — all inside the Netherlands. It is a single relationship, listed once.
- Cloudflare does not touch the app. It handles DNS and this marketing site only. The platform, app.untameddata.com, resolves straight to our own server and does not pass through Cloudflare's proxy — no customer traffic and no footage goes through it.
Services we use that are not sub-processors
A few services appear here for completeness — leaving them off only invites the question of what else was left off. None of them process customer data on our behalf.
They receive some technical data, but not as our processor:
- Open-Meteo — for the weather at a capture, we send an approximate camera location (rounded to roughly 11 km) and a timestamp, not tied to any person. That is not personal data, so nothing is processed on our behalf.
- Esri — map tiles are fetched directly by your browser, so Esri is not our processor. Because your browser contacts Esri, and the map sits behind the login for signed-in users, how that is handled is described in our Privacy Policy.
- Simple Analytics (the Netherlands) — cookieless, no-IP visitor statistics for this marketing site only, never inside the platform. It records only aggregate data, not personal data, stored in the Netherlands — so nothing is processed on our behalf.
They never touch customer data or footage at all:
- Scaleway — stores our container images only (Amsterdam).
- GitHub — source code and CI.
- Kaggle — where our recognition model is downloaded from; a download to us, no footage is ever sent there.
Changes to this list
We give organization owners 30 days' notice — on this page and by email — before we add or replace a sub-processor, so you always know who processes your data before it changes. The one exception is an emergency: if a provider fails or a security issue forces a fast change, we make the change and tell you as soon as we can, with the reason.
Coming October 8, 2026: Spryng, for SMS alerts. Announced today, September 7, 2026, under the 30-day notice above. For WolfDetect alerts we're adding an SMS provider, Spryng. It will handle the phone number you register for alerts and the content of the alert itself: which camera, and when. No footage or images are sent by SMS. It isn't in use yet. Its entity, where the data sits, and the transfer safeguard will be added to the table above once confirmed, before the first alert is sent.
Questions about how we handle your data? Get in touch, or read our Privacy Policy.
Last reviewed: September 7, 2026.
