Managed service trust register

Where managed OpenPost data is stored and processed.

This register is for customers and operators reviewing the managed service boundary.

This dated register names the infrastructure, optional services, user-directed recipients, and human access boundary for app.openpost.social. It does not make a certification claim.

Reviewed: 11 August 2026
Review due: 11 November 2026

Primary service data

Falkenstein, Germany (FSN1)

Media objects

Cloudflare automatic placement; no jurisdiction restriction is configured

Human access

One named operator; key-only SSH and sudo; no two-person approval.

Data locations

Each storage boundary has a different retention rule.

Browser-local editor data is included so the boundary is explicit even before anything reaches the managed service.

Application, database, and logs

Hetzner Online GmbH

Falkenstein, Germany (FSN1)

Data: Accounts, workspaces, drafts, schedules, encrypted social credentials, billing status, and operational logs.
Retention: Active service data is kept while needed to provide the account and for the legal, security, and dispute periods described in the Privacy Policy. Managed host journals are size-bounded to 50 MiB of persistent storage and 10 MiB of runtime storage rather than kept for a fixed number of days.
Protection: The host uses key-only SSH, blocks direct root and password login, and limits database and service access to the application and operator boundary.

Database and media recovery copies

Hetzner Online GmbH

Falkenstein, Germany (FSN1)

Data: Daily PostgreSQL dumps, a synchronized media copy, and retained changed or deleted media versions.
Retention: Routine database dumps and changed or deleted media versions are pruned by the next daily run after they are more than 14 days old. Operator-created repair or incident snapshots are reviewed separately and kept only while needed for recovery, security, legal duties, fraud prevention, or legal claims.
Protection: Recovery files are root-owned and not served by the application. OpenPost does not add a separate application-level encryption layer to each artifact. A weekly restore drill validates the latest database copy and the media inventory.

Uploaded and generated media

Cloudflare, Inc. (R2)

Cloudflare automatic placement; no jurisdiction restriction is configured

Data: Uploaded media, editor exports saved to Media, thumbnails, and object metadata.
Retention: Live objects follow account, workspace, trash, and media-retention rules. The separate host recovery copy follows the retention described above.
Protection: OpenPost uses authenticated HTTPS access and private storage credentials. Objects that must be fetched by a selected social network can receive a signed or public delivery URL.

Browser-local editor data

The user's browser and device

The user's device

Data: Unsynced Image Editor recovery data and local Video Editor projects, sources, recordings, transcripts, analysis, models, and exports.
Retention: Data remains until the user deletes it, the product removes an expired local artifact, or site data is cleared.
Protection: This data is outside the managed cloud until the user chooses a cloud save, Media save, or composer handoff. Device and browser security remain the user's responsibility.

Service-provider register

Required services and feature-triggered recipients are named separately.

“Feature-triggered” means no request is sent until that feature is used. A provider's role describes this OpenPost data path; it does not replace the provider's own terms.

Hetzner Online GmbH

Required service

Subprocessor

Purpose: Runs the managed application host, PostgreSQL database, local recovery copies, and operational logs.
Data: The service data stored or processed by the managed application, plus limited infrastructure metadata.

Location: Falkenstein, Germany (FSN1).
Transfer facts: The primary customer-data host is in Germany. Hetzner states that data remains in the EU unless it identifies another transfer.

PostHog, Inc.

Required service

Subprocessor

Purpose: Receives managed product, public-site, service, and error telemetry so OpenPost can measure use, diagnose failures, and improve the hosted service.
Data: Cookieless public-site events; opaque managed-service user and workspace identifiers; product and service events; browser, service, release, route-template, status, and sanitized error context. OpenPost does not enable session replay or send post content, media, credentials, request bodies, email addresses, names, usernames, query strings, or raw URLs as telemetry properties.

Location: PostHog EU Cloud in Frankfurt, Germany.
Transfer facts: OpenPost selects PostHog's EU Cloud. PostHog describes its GDPR commitments and international-transfer safeguards in its privacy and GDPR documentation.

Cloudflare, Inc.

Required service

Subprocessor

Purpose: Stores media in R2 and delivers the public marketing and documentation sites and their static assets.
Data: Media objects and metadata; public-site request metadata such as IP address, user agent, requested URL, and timing.

Location: R2 uses automatic placement and is not restricted to one jurisdiction. Public-site delivery uses Cloudflare's global network.
Transfer facts: Cloudflare documents its international transfer mechanisms in its privacy policy and customer DPA.

Add Rabbit LLC (Purelymail)

Required service

Subprocessor

Purpose: Sends account verification, password reset, security, and opted-in notification email.
Data: Recipient address, sender address, email content, and delivery metadata.

Location: Provider-operated Amazon Web Services infrastructure; OpenPost does not pin a region in its SMTP configuration.
Transfer facts: A managed-service transfer mechanism has not yet been recorded in this register. This is an open operator and legal review item.

Paddle group

Used for purchases

Controller and processor

Purpose: Provides checkout, subscription management, payment processing, tax, fraud controls, refunds, and customer billing portals as Merchant of Record for Paddle orders.
Data: Account and transaction identifiers, contact and billing details, subscription state, tax information, fraud signals, and payment details entered directly into Paddle.

Location: Paddle lists controller entities in the United Kingdom, Ireland, United States, and Canada and uses further service providers.
Transfer facts: Paddle states that it uses Standard Contractual Clauses or other safeguards when a transfer is not covered by adequacy.

OpenRouter, Inc.

Used when the feature runs

Subprocessor

Purpose: Routes an automatic image-description request after the user adds an image with no saved alternative text.
Data: A 400-pixel JPEG thumbnail, up to 1,000 characters of relevant draft context when present, locale, model, and request metadata. The original image is not sent.

Location: OpenRouter infrastructure; the managed request is restricted to a named EU model-hosting endpoint.
Transfer facts: The managed request denies provider data collection and requires a zero-data-retention endpoint. OpenRouter still keeps non-content request metadata as described in its policy.

Microsoft Azure

Used when the feature runs

Subprocessor

Purpose: Hosts the managed automatic image-description model selected through OpenRouter.
Data: The same thumbnail, optional bounded draft context, and generation instructions sent through OpenRouter.

Location: European Union endpoint selected as azure/eu.
Transfer facts: The managed request disables fallbacks, denies data collection, and requires OpenRouter's zero-data-retention classification for this endpoint.

Discord Netherlands B.V. / Discord Inc.

Used when feedback is sent

Independent service provider

Purpose: Receives feedback reports sent through the managed in-app feedback form.
Data: The report text, optional screenshot, category, app version, route, workspace-safe diagnostics, and delivery metadata that the user chooses to submit.

Location: Provider-controlled infrastructure; Discord identifies its EEA controller in the Netherlands and also operates in the United States.
Transfer facts: Discord's privacy policy describes its international processing. OpenPost does not claim a separate Discord DPA for this feedback path.

Pexels

Used when the feature runs

User-requested source

Purpose: Returns stock photo and video search results when the user searches the editor library.
Data: Search text, server request metadata, selection/download events required by the provider, and no OpenPost account credential.

Location: Provider-controlled infrastructure; no region is pinned by OpenPost.
Transfer facts: The user initiates the search; Pexels' privacy terms apply to its processing.

Pixabay

Used when the feature runs

User-requested source

Purpose: Returns stock image and video search results when the user searches the editor library.
Data: Search text, server request metadata, and no OpenPost account credential.

Location: Provider-controlled infrastructure; no region is pinned by OpenPost.
Transfer facts: The user initiates the search; Pixabay's privacy terms apply to its processing.

Unsplash

Used when the feature runs

User-requested source

Purpose: Returns stock photo search results when the user searches the editor library.
Data: Search text, server request metadata, selection/download events required by the provider, and no OpenPost account credential.

Location: Provider-controlled infrastructure; no region is pinned by OpenPost.
Transfer facts: The user initiates the search; Unsplash's privacy terms apply to its processing.

User-directed recipients

Publishing and sign-in send data only to the service the user selects.

These networks are not general OpenPost subprocessors. Their own terms apply when a user connects an account, signs in, or sends content.