- Entity
- SEVEN KG LLC, a Kansas domestic limited liability company
- Kansas Business ID
- 10090770
- Data protection contact
- privacy@svnkg.com
- List current as at
- October 5, 2026
- Notice period before a change
- 30 days
A sub-processor is a third party that touches customer data on our behalf. This list names every one, what it does, and where it sits. It is referenced by Annex III of our Data Processing Agreement and is kept current.
Why this list exists
When you sign our Data Processing Agreement you authorise SEVEN KG to process your data. Every vendor we use that touches that data is a sub-processor — a subcontractor of the processing. You do not stop being responsible to your own clients because you hired us, so you need to be able to name who touches their information.
“SEVEN KG, and whoever SEVEN KG uses” is not an answer that survives an examination. This page is the answer that does.
The list
- Cloudflare, Inc.
- DNS, TLS termination, protection against attack, and hosting of the static website — United States and global edge — September 2026
- Hetzner Online GmbH
- The server that runs the verification service — Falkenstein, Germany — September 2026
- Cloudflare R2 — backups
- Object storage for encrypted database backups — Eastern North America, United States — September 2026
- Cloudflare R2 — evidence bundles
- Object storage for sealed evidence bundles during their download window — Western Europe — September 2026
- Stripe, Inc.
- Takes payment, issues invoices, and holds the billing contact and the address needed to work out sales tax — United States — October 2026
- Fastmail Pty Ltd
- Receives mail sent to our published addresses — United States — September 2026
Two disclosures a reader is entitled to have
Cloudflare sees traffic in the clear. It terminates TLS at its edge in order to protect the service against attack, which means it necessarily handles requests to us in decrypted form. That is inherent to using a protective edge network and is not a configuration we could change while keeping the protection.
Evidence bundles and database backups sit in different places. Sealed evidence bundles are stored in Western Europe; encrypted database backups are stored in the United States. Both are ciphertext before they leave our server, so neither location holds anything the storage provider can read — but they are different jurisdictions and a reader is entitled to be told which is which rather than left to assume one answer covers both.
Our server is in Germany and our backups are in the United States. We chose Hetzner for EU jurisdiction, and it would be easy to let that imply the backups are there too. They are not. What sits in the United States is ciphertext: every database copy is encrypted before it leaves the server, under a key Cloudflare does not hold and cannot obtain, so the storage provider holds bytes it cannot read. We would rather state the location plainly than let the choice of a German server carry more weight than it deserves.
What is deliberately not here
We use no analytics provider, no advertising network, no customer relationship management system, no error-reporting service, no session recorder, no chat widget, and no artificial intelligence vendor that receives customer data. The public website makes no third-party request of any kind, which you can confirm in your browser’s developer tools rather than taking our word for it.
We use a payment processor, and it holds what we deliberately do not. Stripe takes payment, issues the invoice, and holds the billing contact and the address it needs to work out sales tax. We do not keep that address. Our own invoice record holds the month, the number of devices, the amount, the dates and a reference to Stripe’s record — nothing that identifies the person paying. Card and bank details never reach us at all.
How this list changes
We give customers under a Data Processing Agreement at least thirty days’ written notice before engaging a new sub-processor. If you object on reasonable data protection grounds within that period we will discuss it in good faith, and if we cannot resolve it you may terminate the affected service without penalty and receive a pro-rata refund of any unused balance.
Removing a sub-processor needs no notice, for the obvious reason.
This page carries the date it was last current. If that date is old, ask us — a stale sub-processor list is a broken one, and we would rather be told than quietly rely on it.
What changed in this version
- 1.1
- October 5, 2026 — Stripe added, having gone live on October 2, 2026. No customer was under a Data Processing Agreement when it was engaged, so the thirty days’ notice above was owed to no one; the list was updated as soon as the processor went live. The evidence-bundle bucket in Western Europe named separately from the backup bucket in the United States. The statement that we use no payment processor removed, because we now do.
- 1.0
- September 19, 2026 — First published.
Contact
- Questions about this list
- privacy@svnkg.com
- To request the Data Processing Agreement
- legal@svnkg.com
- Postal
- SEVEN KG LLC, 4601 E. Douglas STE 150, Wichita, Kansas 67218, United States