What a sub-processor is
Some parts of running VKT rely on another company — content delivery, network protection. Under the GDPR those companies are sub-processors: VKT has to name them, and stays responsible for what they do.
Legal
Sub-processors
Who touches your people data should fit on one screen. This is the complete list of sub-processors VKT uses today — nothing is kept off the page.
How many there are
One third party: Cloudflare. It sits in front of the site as a reverse proxy, forwards requests and blocks attack traffic. Request content is not used for any other purpose.
Why the database is listed
Application data lives in a MySQL instance we operate ourselves in Osaka, Japan. That is VKT processing data directly, not a third-party sub-processor — it appears in the table only so the picture is complete.
Current list
| Provider | Purpose | Location | Notes |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, WAF, edge caching | Global edge network | Reverse proxy; request content is not used for any other purpose |
| VKT self-operated MySQL | Customer data storage | Osaka, Japan | Self-hosted, not a third-party processor; listed for transparency |
No other sub-processors are engaged today. Any change follows the process below.
When the list changes
- 30 days ahead Before adding or replacing a sub-processor, we update the table on this page and notify workspace admins in the app.
- 15 days to object You can object in writing on data-protection grounds within 15 days of the notice.
- If we cannot agree If no agreement is reached within 30 days, you may terminate the affected service. Fees already paid are handled under the Terms of Service.
Get notified
Email [email protected] with the subject “sub-processor updates” and we will write only when this list actually changes — no newsletters.