This page lists the sub-processors CyberLuka engages to deliver the Service. We require each sub-processor to provide security and confidentiality protections at least equivalent to those in our Terms of Service and Privacy Policy. All transfers comply with Chapter V GDPR; primary data is stored in the European Union.
Notice of changes. We will notify customers of intended additions or replacements to this list at least 30 days in advance, by email and by updating this page. If you have a reasonable data-protection objection to a new sub-processor, you may terminate your affected games and receive a pro-rata refund of unused fees, as set out in section 4.4 of the Terms of Service.
Current sub-processors
| Sub-processor | Purpose | Location & transfer safeguards |
|---|---|---|
Microsoft Azure Microsoft Ireland Operations Limited | Hosting (App Service, Container Apps, Cosmos DB, Service Bus, Storage), transactional email (Azure Communication Services), telemetry (Application Insights). | European Union — primary region: West Europe (Netherlands). Primary data stays in the EU. Where Microsoft sub-processes outside the EEA, EU Standard Contractual Clauses and the EU–US Data Privacy Framework apply. |
Cloudflare Cloudflare Germany GmbH (EU) and Cloudflare, Inc. (US) | DNS, edge network, CDN, network-layer security, Cloudflare Workers (request routing), Workers KV (subdomain-to-game lookup). | Global edge network; EU-region data residency for KV. EU Standard Contractual Clauses; Data Privacy Framework certification. |
Stripe Stripe Payments Europe Limited (Ireland) | Payment processing, Stripe Checkout, fraud prevention, billing receipts. Stripe is the controller for cardholder data. | European Union (Ireland), with limited support flows in the US. EU Standard Contractual Clauses; Data Privacy Framework certification; PCI-DSS Level 1. |
GitHub GitHub B.V. (Netherlands) / GitHub, Inc. (US) | Source-code hosting for the platform and the public CTF lab catalogue. Used at runtime to discover labs via topic search. No customer or player personal data is stored on GitHub. | United States (with EU/EEA contracting entity). EU Standard Contractual Clauses; Data Privacy Framework certification. |
AI inference provider
CyberLuka does not currently engage an AI-inference sub-processor in production. When AI-enabled CTF labs are enabled (planned in a future phase), we will list the specific provider on this page and update this section before any player data is processed by that provider. AI inference will be configured to run in an EU region and subject to the safeguards above.
Internal infrastructure (not sub-processors)
The following providers handle technical metadata only and do not process customer or player personal data: domain registrar (GoDaddy), and our development tooling (CI logs, error tracking). They are listed here for transparency.
Questions and DPAs
For an executable Data Processing Agreement, an updated sub-processor list, or to ask a question about any of the providers above, contact privacy@cyberluka.com.