What a sub-processor is here
Any third party that could, in the course of running the service, process data belonging to you or to the people who open your links. If a vendor never sees that data, it is not on this list. The default posture is to keep the list as close to empty as the stack allows.
The list
| Provider | What it does | What it can see |
|---|---|---|
| The infrastructure platform | Runs the code, the database and the object storage | Everything the service stores — it is where the service runs |
| The transactional email provider | Sends sign-in links, email-gate codes and the optional digest | Recipient addresses and the message body of those emails only |
| The OAuth identity provider | Optional sign-in with an external account | Only what an OAuth sign-in discloses — an account id and email, if you use it |
That is the whole list. There is no analytics vendor, no advertising network, no CDN outside the infrastructure platform, and no data broker — because none of those is wired into the code.
Why it is this short
The service collects little to begin with (see /privacy), and a self-hosted deployment has no separate company standing between you and your data. On your own install you can shorten the list further — bring your own SMTP, disable OAuth — and the honest answer is that nobody but the operator of the infrastructure account has a path to what is stored.
Changes
If a deployment adds a sub-processor, that belongs here before it goes live, not after. This page is the record — the same discipline the rest of the site holds itself to: say what is true, and let anyone verify it.