Who else touches your data, and where they are
Sub-processors
The current list of runnerhut sub-processors with location and purpose, and the notice period before it changes.
Updated 2026-08-14
A sub-processor list that is hard to find is a signal in itself. This one is published, versioned, and changes carry 30 days' notice and a right to object.
| Purpose | Location | Accesses customer data? |
|---|---|---|
| Compute and storage infrastructure | EU (region you select) | Yes — encrypted at rest and in transit |
| Object storage for cache and artefacts | EU (region you select) | Yes — encrypted, per-repository keys |
| Error monitoring | EU | No — telemetry only, build content scrubbed |
| Billing and invoicing | EU | No |
| Email delivery | EU | No |
| Customer support tooling | EU | Support correspondence only |
Notice of change
- 30 days' written notice before a new sub-processor begins processing
- A documented right to object during that window
- Version history retained so you can evidence to an auditor what applied when
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.