Legal
Sub-processors. Every outside service, and what it sees.
The companies whose services ZestSSH relies on. None of them can read a synced vault or a team’s items: those are encrypted on your devices before they leave.
Our own servers
ZestSSH Cloud (the sync service, accounts, teams and support tickets) runs on servers that we operate ourselves, in the United States. No cloud provider hosts its database. Its backups are encrypted on our own hardware before they are stored, and the offsite copy is held by Backblaze, below.
Every outside service
“Works for us under contract” means the company processes personal information only to provide its service to us. “Its own policy applies” means you deal with that company yourself, when you choose to (a sign-in, a store, the Discord community).
| Service | What it does for ZestSSH | What it sees | When | Where |
|---|---|---|---|---|
| Cloudflare(privacy policy, opens in a new tab) Cloudflare, Inc.Works for us under contract | Runs zestssh.com and docs.zestssh.com, serves the installers, and sits in front of ZestSSH Cloud, where it ends the HTTPS connection and blocks attacks. | Every request to our sites and to ZestSSH Cloud passes through it, so it sees IP addresses and request details. Request logs are turned off for the two websites, so it keeps no log of your visits for us. Synced vaults stay end-to-end encrypted through it. | Whenever you visit a site or use ZestSSH Cloud | Its global network; a company in the United States |
| Firebase Authentication (Google)(privacy policy, opens in a new tab) Google LLCWorks for us under contract | Signs you in, checks two-step sign-in codes, and (for a team with company sign-in) connects to the company’s identity provider. | Your email address, an account id, how you sign in, and your authenticator secret if you turn on two-step sign-in. Its library in the app adds the device model and the days the app was used. | Only if you sign in | United States |
| Google, Apple and Microsoft sign-in Google LLC, Apple Inc., Microsoft CorporationIts own policy applies | Let you sign in with an account you already have. | That you signed in to ZestSSH with their account. | Only if you choose one of them | United States |
| Stripe(privacy policy, opens in a new tab) Stripe, Inc.Works for us under contract | Takes payments on this website, sends team invoices, and runs Business subscriptions. | Your card or other payment details (we never do), your email address, your account id, what you bought and, for a team, the billing email and any purchase order number you give. | Only when you buy on the website | United States |
| App Store and Google Play Apple Inc., Google LLCIts own policy applies | Sell the personal plans inside the apps, and deliver the apps. | Their own records of your purchase and download. | Only when you buy or install from them | United States |
| RevenueCat(privacy policy, opens in a new tab) RevenueCat, Inc.Works for us under contract | Confirms purchases from the stores and from Stripe, and tells the app what you own. | An app user id (random before you sign in, your account id after) and the store receipt. On phones and tablets, its library adds the device model, OS version, languages, store country and app version, and on iOS Apple’s per-developer device identifier. | Phones and tablets: when the app opens. Computers: through our server, while signed in | United States |
| Resend(privacy policy, opens in a new tab) Resend, Inc.Works for us under contract | Sends our emails: address checks, password resets, two-step sign-in notices and team invitations. | The address it sends to, and the message with its one-time link (for an invitation, also who invited you and to which team). | Only when one of those emails is sent | United States |
| Backblaze(privacy policy, opens in a new tab) Backblaze, Inc.Works for us under contract | Holds the offsite copy of our server backups. | Only backups already encrypted with AES-256 on our own hardware. It cannot read them. | Every day | United States |
| Discord(privacy policy, opens in a new tab) Discord Inc.Its own policy applies | Our community, and where the bug reports and suggestions you send from the app are posted. | What you write in a report, the six facts shown to you before sending, and a screenshot (redacted by default) or a Discord handle if you add one. What you post in the community yourself is between you and Discord. | Only when you send a report or suggestion, or use the community | United States |
Inside the app, and only when you use them, Google’s ML Kit (the QR code scanner on Android) and your device’s own speech recognizer are used; the privacy policy says what each sends.
Those that handle team data
These are the sub-processors under the data processing addendum, for the data we process for a team on the Team or Business plan:
- Cloudflare, Inc. (Cloudflare): Runs zestssh.com and docs.zestssh.com, serves the installers, and sits in front of ZestSSH Cloud, where it ends the HTTPS connection and blocks attacks. Its global network; a company in the United States.
- Google LLC (Firebase Authentication (Google)): Signs you in, checks two-step sign-in codes, and (for a team with company sign-in) connects to the company’s identity provider. United States.
- Stripe, Inc. (Stripe): Takes payments on this website, sends team invoices, and runs Business subscriptions. United States.
- Resend, Inc. (Resend): Sends our emails: address checks, password resets, two-step sign-in notices and team invitations. United States.
- Backblaze, Inc. (Backblaze): Holds the offsite copy of our server backups. United States.
Changes
Before a new sub-processor starts handling a team’s personal information, we add it here at least 30 days ahead, with the date. A team may object, as the data processing addendum describes. To be told by email, write to support@zestssh.com.
- 23 October 2026: this list published for ZestSSH 3.0.
© 2026 Affluent Labs LLC. All rights reserved.