Sub-processors
Third-party services that process data on our behalf. Last updated 2026-10-10.
1. Overview
VoltageGPU (VOLTAGE EI, France) uses the third-party service providers listed on this page to deliver its services. Every provider that may process personal data or customer workloads on our behalf is listed, including the compute providers that run your GPUs.
All sub-processors are bound by data processing terms that require them to protect personal data in accordance with the GDPR and other applicable data protection laws.
2. Confidential and standard compute
These providers run the customer workloads. They are the most important entries on this page.
Confidential GPU compute inside Intel TDX trust domains (the Confidential VM tier; the confidential container tier was retired by the provider on October 1, 2026). The workload runs on their hardware; VoltageGPU has no technical access to trust-domain memory or disk. NVIDIA GPU attestation has been verified from inside the VM on single-GPU H200, H100 and RTX PRO 6000 Blackwell VMs, and per GPU on the 8x H100 node (Protected PCIe mode, NVSwitch not verified); the 8x H200 node is not attested yet.
Standard, non-confidential GPU rentals (the "Standard GPUs" tab and the standard tier of the API). The workload runs on an independent host's machine: no memory encryption, no TDX quote, no GPU attestation. Do not use this tier for sensitive data.
Confidential inference API (TEE-attested open-weight models behind the OpenAI-compatible endpoint) and the model runtime of the Confidential AI Agents.
3. Application hosting and data
These providers host the website, the API and the customer database.
Web application and API hosting, edge delivery.
PostgreSQL database hosting for accounts, billing and pod records.
Virtual private server hosting the web-terminal bridge, operational scripts, internal agents and our self-hosted Umami analytics instance.
4. Payments
These providers handle payment transactions. VoltageGPU never stores card numbers.
Card payments and invoicing (PCI DSS Level 1).
Cryptocurrency checkout.
Bitcoin transaction monitoring for direct BTC top-ups (wallet addresses and transaction ids only).
Blockchain transaction monitoring for wallet top-ups (wallet addresses and transaction ids only).
5. Email and notifications
These providers deliver the emails we send you and the alerts we send ourselves.
Transactional email (address verification, password reset, invoices, payment confirmations; the main transport since September 17, 2026) and product-update email delivery.
The contact@ mailbox (incoming mail and our replies), and an SMTP relay used by a few forms such as the enterprise contact form and as a fallback when Resend fails.
Internal operational alerts to the founder. Since 16 September 2026 email addresses are masked before sending (j***y@example.com), so the alerts carry order and support metadata but no usable customer address.
6. Analytics and monitoring
These services help us understand traffic and check that the site is up.
Website analytics since September 18, 2026 (it replaced Plausible): aggregate page views and named events, no cookie, no identifier, served from our own domain. No third party other than OVH as the host receives this data.
Public uptime monitoring of voltagegpu.com. No customer data.
7. Authentication
Authentication runs on our own infrastructure, with an optional Google sign-in.
Authentication framework. Credentials stay in our database (Neon, Frankfurt).
Optional. If you choose to continue with Google, Google authenticates you and sends us your name and email address. Password sign-in does not involve Google.
8. Where your data and workloads actually run
VoltageGPU is a French company under EU law, and the customer database is hosted in Frankfurt. That does not make the whole service EU-only: the website runs on a US edge network, several payment and monitoring providers are US companies, and the GPU hardware is operated by a US provider whose data-center locations vary with capacity.
If your workload requires EU-only placement, ask us in writing before relying on it. We will confirm what can be guaranteed for that specific request, and we will not claim EU residency we cannot verify.
9. Data transfer mechanisms
For sub-processors located outside the European Economic Area, we rely on:
- Standard Contractual Clauses (SCCs): EU-approved contractual terms
- Data processing agreements: GDPR-compliant contracts with each sub-processor
- Data minimisation: payment and monitoring providers receive only the fields they need
10. Changes to sub-processors
When we add a sub-processor that processes personal data, we will:
- Update this page at least 30 days before the change takes effect
- Notify customers who have subscribed to sub-processor updates
- Give customers the opportunity to object to the new sub-processor
Subscribe to updates: email privacy@voltagegpu.com with the subject "Subscribe to sub-processor updates".
11. Objection process
If you object to a new sub-processor, you may:
- Contact us within 30 days of the notification
- Explain the grounds for your objection
- Work with us on an alternative
- Terminate your agreement if no resolution is possible
12. Contact
Privacy team
13. Last updated
Last updated: 2026-10-10 (analytics now self-hosted Umami instead of Plausible; Upstash and Sentry removed, no longer used; Resend as the main transactional mail transport; Google sign-in listed; confidential container tier retired by the provider; standard-tier provider described as a GPU marketplace partner)
Previous update: September 4, 2026 (added the compute providers, removed two hosting entries that were never used, corrected locations)
Next review: December 2026