Sub-processors

This page lists every third party that processes customer personal data on behalf of Berserk under a Data Processing Agreement (DPA). Customers under a DPA are notified at least 30 days before a new or replaced sub-processor processes their data, and may object on reasonable security or compliance grounds during the notice period. To receive these notices, email legal@bzrk.dev with the subject Sub-processor updates.

The contracting entity is Berserk AB, org.nr 559603-5179, Sweden. Berserk ApS (Denmark) and the companies it controls or that are under common control with it, including Berserk AB, form the Berserk Group. Under the DPA each member of the Berserk Group is the processor, and Berserk AB signs for all of them and answers to the customer for each. Group members are therefore not listed as sub-processors. Berserk engineers in Denmark and Sweden operate and support hosted instances.

Hosted instances

Applies to customers whose Berserk instance is operated by Berserk. The data region is the one stated in the customer's Order Form.

Sub-processor	Service	Data	Location
Amazon Web Services EMEA SARL	Compute, object storage and database for the instance	All telemetry the customer sends, user accounts, instance configuration	EU, Frankfurt (eu-central-1), or the region in the Order Form
Google Cloud EMEA Limited and its affiliates, including Google LLC	Compute, object storage and database for the instance	All telemetry the customer sends, user accounts, instance configuration	EU, Finland (europe-north1), or the region in the Order Form, which may be in the United States

Where a sub-processor processes customer personal data outside the EU/EEA, the transfer relies on the safeguards set out in the DPA.

These are not sub-processors:

• Hetzner Online GmbH (Finland) and Scaleway SAS (Poland) host Berserk's internal monitoring. It receives the operational logs of Berserk's own services, which can include user account details such as email addresses and user IDs. It never receives customer telemetry or query results. Berserk processes these logs as controller, to operate and secure its systems, under its privacy notice.
• Netbird carries encrypted traffic between Berserk's clusters. The tunnel is end-to-end encrypted and Netbird's control plane sees peer metadata only.
• Let's Encrypt issues TLS certificates and sees hostnames only.
• AI model providers such as Anthropic, OpenAI, Google, Mistral, xAI or any provider the customer configures. The AI assistant in Berserk is off by default. When a customer administrator enables it, the assistant sends prompts and the data the customer selects to the provider the customer chooses, using the customer's own API key. That provider is the customer's processor, not Berserk's.
• Alerting and workflow destinations such as SMTP, Slack, Discord and webhooks are configured by the customer and are the customer's processors.

Self-hosted instances

None. Customer telemetry stays inside infrastructure the customer operates. Berserk does not receive, route or store it in normal operation.

Support engagements

If a customer engages Berserk for hands-on support and voluntarily shares data under the Data Processing Agreement, that data is processed on the assigned engineer's laptop, which is full-disk encrypted and controlled under Berserk's access-control and cryptography policies. If the customer chooses email as the channel, it is also processed in the engineer's Berserk mailbox.

Sub-processor	Service	When it applies	Location
Proton AG	Email and drive (if used)	Email-channel support engagements only	Switzerland (adequacy decision)

What is not on this list

Services Berserk uses to run itself as a company, such as source-code hosting, internal chat, the identity provider for staff, engineering tooling and the CRM, are not sub-processors under GDPR Article 28. They do not process customer personal data on the customer's behalf. They are tracked in the internal supplier register, available under NDA on request to legal@bzrk.dev.

Change log

• 2026-10-07: hosted-instance section added (Amazon Web Services, Google Cloud). Hetzner and Scaleway explained as Berserk's own vendors for internal monitoring. The Berserk Group explained as the processor, so group members are not listed. AI model providers, Netbird and Let's Encrypt explained as not sub-processors.
• 2026-05-01: first version, support engagements only.

Contact

Questions about sub-processors: legal@bzrk.dev.