Who else touches your data
Four companies, and what each one can actually see. Most vendors publish this list as a name and a country; the column that matters is the last one.
| Who | What for | Where | What it can see |
|---|---|---|---|
| Hetzner | Servers and the database | India | Everything, as the machine the service runs on. Encrypted at rest. |
| Cloudflare | DNS, CDN and static hosting | Global edge | Requests in transit — addresses and headers, not records. |
| Backblaze B2 | Encrypted backups | India | Encrypted archives it cannot read. |
| Resend | Transactional email | EU / US | A recipient's name and address. Never marks, fees or attendance. |
Scroll sideways for what each one can see.
What is not on this list
Analytics vendors, advertising networks, data brokers, CRM tools and AI providers. Nothing about a school's students leaves the four above. We do not sell data, run advertising, or train models on anybody's records.
Notice before, not after
If this list changes, schools hear from us before the new sub-processor is used — not in a changelog somebody has to check. That is a term of the agreement rather than a courtesy. If you want to be told, tell us the address to write to at hello@timelino.com.
Each one is bound to the same terms
A sub-processor may only do what we may do, for the purpose your school instructed, with the same security obligations and the same breach-notice duty flowing back to you. That is set out in the data processing agreement your school signs.
What we do so the list stays short
School data is stored in India. Backups are encrypted before they leave the machine, so the storage provider holds archives it cannot read. Email carries a recipient's name and address and nothing else — never marks, fees or attendance. And this website makes no third-party requests at all: no fonts from a CDN, no embedded video, no tag manager beyond the analytics described in the cookies page.
The rest of the picture
How isolation is enforced, what the backups actually restore, and what a mis-scoped query returns are on the security page.