Sub-processors
Under GDPR Art. 28 a processor has to name the sub-processors it engages. This page is that list, kept separate from the privacy policy so it can be sent to a security reviewer on its own.
Who processes data on our behalf?
| Sub-processor | Purpose | Data reaching it | Operating region |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Request metadata for pages served: IP address, user agent, requested URL | Global edge network, US-headquartered |
| Cloudflare | Bot protection (Turnstile) on the authentication forms | Request metadata and challenge signals from sign-in and registration attempts | Global edge network, US-headquartered |
| Mintlify | Documentation hosting at /docs | Request metadata for documentation pages | US-headquartered |
Trade execution, pricing, settlement and the merchant ledger run on infrastructure AssetPay operates. Skin trades themselves settle through Steam, which is Valve's platform and the counterparty your users already have an account with — it is not a sub-processor we engage on your behalf.
How do international transfers work?
Some of the providers above operate outside the European Economic Area. Where personal data is transferred out of the EEA we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision covering the destination country.
How do I get the DPA?
Email support@assetpay.gg from your merchant account address and ask for the Data Processing Agreement. The same address gets you an up-to-date copy of this list if you need it dated and signed for a security review.
Who is the controller?
For merchant account and billing records, AssetPay Oy (Finnish business registration 3537599-6) is the controller. For end-user data flowing through your checkout, the merchant normally decides why the processing happens — which makes the merchant the controller and AssetPay the processor acting on their instructions. The split is set out in full in the privacy policy, and the controls behind it are described on the security page.
Will this page change?
Yes — engaging a new sub-processor means updating this table. Merchants under contract are notified of changes directly, as the DPA requires. The date at the top of this page reflects the last review.
Questions about anything on this page go to support@assetpay.gg.