Last updated: 1 October 2026
BehindLink is run by Neshys, MB (Lithuania, company code 307595831). When we process personal data on a customer's behalf (the people it signs up to the portal, the people and addresses that receive its alerts, and the reports, emails and requests its team sends us) we use the service providers below. Each works under a written agreement that binds it to data protection terms at least as protective as our data processing agreement with the customer.
| Provider | What it does for us | Personal data involved | Where | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts the service: servers, database and evidence storage | All customer data we hold | Helsinki, Finland (EU) | None needed: stays in the EU |
| Resend, Inc. | Sends service email (sign-in links, invitations, alerts, summaries, receipts) and receives forwarded reports and replies | Email addresses; email content, including forwarded messages and their attachments | United States | Standard Contractual Clauses |
| OpenAI | AI analysis of suspicious pages | Page address and text; how the page was found, which can include a note on a report | United States | Standard Contractual Clauses |
| Anthropic | AI assistant our analysts use to review findings and prepare takedown reports | Findings and their evidence, including notes on reports | United States | Standard Contractual Clauses |
| Proton AG | Our support and business mailboxes | Emails customers send us and our replies | Switzerland | EU adequacy decision |
Backups of the database and evidence are kept by BehindLink itself, on encrypted storage in Lithuania, not by a provider.
We tell customers by email at least 30 days before a new sub-processor starts handling their data, and update this page. A customer may object on reasonable data protection grounds within that time, as its data processing agreement describes.
These providers handle personal data for BehindLink's own purposes, not on a customer's behalf. The privacy page explains each.
| Provider | What it does for us | Where | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosts this website | Falkenstein, Germany (EU) | None needed |
| Formspree, Inc. | Delivers the free-check form on our home page | United States | Standard Contractual Clauses |
| Website analytics, only for visitors who allow it | United States | EU-US Data Privacy Framework | |
| Stripe Payments Europe, Limited | Takes our customers' payments and holds their billing details, invoices and receipts; also an independent controller for its own purposes, such as preventing fraud | Ireland (EU), with transfers to the United States | Standard Contractual Clauses and the EU-US Data Privacy Framework |
Recipients of takedown reports. Hosting providers, domain registrars, platforms, Google Safe Browsing, Microsoft, Netcraft, Cloudflare and national security teams (CERTs) receive our reports about fake sites so they can act on them. They decide what to do with a report themselves, so they are independent controllers, not our processors.
Webhook destinations. If a customer adds a webhook, alerts are posted to the address it chose, for example its own Slack workspace. That service works for the customer, not for us.
Services that receive no customer personal data. To find and inspect fake sites, the engine also uses public certificate logs, urlscan.io, domain registration lookups (RDAP and WHOIS), public DNS resolvers, ScrapeBadger (searches ad libraries and social networks for brand names) and Evomi (a proxy network used to open suspicious pages from a second network). They see brand names and the addresses of suspicious sites, not our customers' people.
Questions: hello@behindlink.com.