Legal
Every company that could touch data processed through Metricward, what it does, where it is, and whether it is actually in use today.
| Company | Purpose | Location | Sees visitor data | Status |
|---|---|---|---|---|
| Metricward (self-hosted infrastructure) | Event ingestion, storage and the dashboard | Sweden | yes | In use |
| Backup storage provider | Encrypted off-site backups | Sweden | yes | Not in use yet, off-site backup storage is not configured |
| Stripe Payments Europe | Subscription billing and invoices | Ireland, US-controlled group | no | Not in use yet, checkout is not wired |
| Mailjet (Sinch) | Transactional email: alerts and reports you configure | France | no | Not in use yet, email delivery is not wired |
| MaxMind | Geographic database file, licensed and queried locally | United States, no data sent | no | In use as a local file |
| Mistral AI | Optional AI features, per-tenant opt-in | France | no | Not built yet |
Nothing on this list is outside the EU or EEA for visitor data.
Stripe is Irish-incorporated for European customers and US-controlled at group level. It processes your company billing details and never visitor data, and that distinction is the reason it is acceptable here. If no US-controlled processor at all is acceptable to you, ask about invoice billing by SEPA, which removes it entirely.
MaxMind appears here but receives nothing.
Geographic lookup runs against a database file held on our own servers. No address is sent anywhere for it. The company is listed because the file is licensed from them, not because they receive data.
Changes get 30 days notice.
Adding or replacing a subprocessor is announced 30 days before it takes effect, with a right to object. That commitment is in the processor terms rather than only here.
This list reflects the shared EU deployment.
A dedicated deployment can differ, and its own list is part of that agreement.
Related: processor terms, what we collect, security.