Subprocessors
legal & privacy · Updated 24 October 2026
TAILORED. Systems uses the following sub-processors to deliver the service. Most infrastructure is located within the EU/EEA. On-model image generation is currently performed by FASHN. The New Black is the planned successor provider; its processing locations and transfer safeguards must be legally resolved (Legal Gate KLE-376) before it is activated for production traffic. We provide at least 30 days' notice before adding or replacing a sub-processor.
| Sub-processor | Purpose | Region |
|---|---|---|
| FASHN (api.fashn.ai) | Garment-on-model image generation — currently the active provider for new and existing jobs | United States; transfer safeguarded by EU Standard Contractual Clauses |
| The New Black (thenewblack.ai / Bubble.io) | Garment-on-model generation — planned successor provider; not yet processing production traffic | Processing location and transfer safeguards must be legally resolved before activation (Legal Gate KLE-376) |
| Stripe Payments Europe | Subscription and payment processing | Ireland (EU entity) with global infrastructure; transfer safeguards require legal review before processing |
| Sentry | Error and performance monitoring | EU data region |
| netcup | Production compute (application containers), PostgreSQL database, S3-compatible image storage (MinIO) and backups | Germany (EU) |
| Hetzner Online GmbH | Reverse proxy and TLS termination (Traefik), deployment control plane (Coolify) and staging | Finland (EU) |
| Resend | Transactional e-mail delivery | Ireland (EU) |
| Cloudflare | Reverse proxy and CDN for the application, and hosting of this website (Cloudflare Pages) | Global network; transfer safeguards to be confirmed |
- Sub-processor
- FASHN (api.fashn.ai)
- Purpose
- Garment-on-model image generation — currently the active provider for new and existing jobs
- Region
- United States; transfer safeguarded by EU Standard Contractual Clauses
- Sub-processor
- The New Black (thenewblack.ai / Bubble.io)
- Purpose
- Garment-on-model generation — planned successor provider; not yet processing production traffic
- Region
- Processing location and transfer safeguards must be legally resolved before activation (Legal Gate KLE-376)
- Sub-processor
- Stripe Payments Europe
- Purpose
- Subscription and payment processing
- Region
- Ireland (EU entity) with global infrastructure; transfer safeguards require legal review before processing
- Sub-processor
- Sentry
- Purpose
- Error and performance monitoring
- Region
- EU data region
- Sub-processor
- netcup
- Purpose
- Production compute (application containers), PostgreSQL database, S3-compatible image storage (MinIO) and backups
- Region
- Germany (EU)
- Sub-processor
- Hetzner Online GmbH
- Purpose
- Reverse proxy and TLS termination (Traefik), deployment control plane (Coolify) and staging
- Region
- Finland (EU)
- Sub-processor
- Resend
- Purpose
- Transactional e-mail delivery
- Region
- Ireland (EU)
- Sub-processor
- Cloudflare
- Purpose
- Reverse proxy and CDN for the application, and hosting of this website (Cloudflare Pages)
- Region
- Global network; transfer safeguards to be confirmed
Change notification
We will notify you by e-mail at least 30 days before adding a new sub-processor or replacing an existing one. You may object to a new sub-processor by contacting privacy@tailored.systems within the notice period. If you object and we cannot accommodate your objection, you may terminate the relevant services by providing written notice.
Data transfers
Most sub-processors listed above operate infrastructure within EU/EEA member states. FASHN's US transfer is safeguarded by EU Standard Contractual Clauses. The New Black is the planned successor provider; its processing location and transfer safeguards must be legally resolved (Legal Gate KLE-376) before it is activated for production traffic. Before processing, each sub-processor must meet the requirements of Art. 28 GDPR.
Security requirements
Each sub-processor is required to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR. Sub-processors are contractually obligated to process personal data only for the specified purpose and to delete data upon termination of the agreement.
Contact
Questions about this sub-processor list should be directed to privacy@tailored.systems.