Storage Providers and Sub-processors

Last updated: 21 October 2026 · To be notified of changes, email contact@ironshard.ai

Storage providers

Coded fragments are distributed across multiple independent storage providers. As explained in our Privacy Policy, fragments held by an individual provider do not constitute personal data, and these providers are not sub-processors.

We use the following providers:

GroupProviderHeadquarters
Global cloud platformsAmazon Web ServicesUnited States
Global cloud platformsGoogle CloudUnited States
Global cloud platformsMicrosoft AzureUnited States
Global cloud platformsIBM CloudUnited States
European cloud providersOVHcloudFrance
European cloud providersExoscaleSwitzerland
European cloud providersHetznerGermany
European cloud providersScanNetDenmark
Developer cloud providersDigitalOceanUnited States
Developer cloud providersAkamai (Linode)United States
Specialist object-storage and edge providersTigrisUnited States
Specialist object-storage and edge providersCloudflareUnited States

Each provider's certifications and audit reports are listed in our Trust Center.

Which providers and locations hold your fragments depends on the locations you select. Region Select is available on every plan, including the free tier: you choose from the locations offered to you, and your fragments are stored only with providers in those locations. The locations in use for your buckets are available to customers on request at contact@ironshard.ai.

Sub-processors

Sub-processorPurposeLocation
Fly.ioGateway processingAmsterdam (Netherlands), Frankfurt (Germany), Stockholm (Sweden), London (United Kingdom), Toronto (Canada), Ashburn, Chicago and Los Angeles (United States)
Google Cloud PlatformControl plane, key storage, logging and monitoringFrankfurt, Germany
CloudflareWebsite hosting and DNSGlobal network; processed nearest the visitor
SentryError monitoring and session replay (gateways and web applications)Frankfurt, Germany (Sentry's EU data region). Sentry is a US company, so its staff may access the data from the United States.
MailgunService communicationsEU region
InfluxDataOperational metricsFrankfurt, Germany

Google Cloud Platform and Cloudflare also act as storage providers, as described above.

We give 30 days' notice before adding or replacing a sub-processor.

Security and compliance information

Each sub-processor publishes its own certifications and audit reports. We rely on them and provide them to customers on request (see clause C.8 of the Data Processing Agreement).

Sub-processorPublished information
Fly.ioCompliance: SOC 2 Type 2 audited; infrastructure in ISO 27001 data centres. SOC 2 report available from Fly.io.
Google Cloud PlatformCompliance resource center, including ISO/IEC 27001, SOC 2 and the Compliance Reports Manager
CloudflareTrust Hub: compliance resources. Compliance documents are available through Cloudflare's dashboard.
SentryTrust: SOC 2 Type 2 report and ISO 27001 certificate
InfluxDataSecurity: SOC 2 Type 2 and ISO 27001
MailgunMailgun security and compliance