Who helps us run the service
Effective November 6, 2026
Environmental Nexus LLC uses a small number of providers to host and run Environmental Nexus. This page lists the providers that process customer data on our behalf (subprocessors), the providers we use for our own billing and website, and the outside services that receive limited information when you use certain features.
Subprocessors
These providers process customer data for us under written contracts with data protection terms:
- IONOS Inc.: Hosts the application, its database and stored files, and its encrypted backups. Data: All Customer Data and account information. Location: United States.
- Cloudflare, Inc.: Domain name service, encrypted connections and network protection for the application. Data: All data passing between users and the application, including IP addresses. Location: United States; global network.
- InterServer, Inc. (MailBaby): Delivers the email the application sends, such as invitations, notifications, and the reports, letters and messages users send to their clients without a connected mailbox. Data: Sender and recipient names and addresses, message content and attachments. Location: United States.
- Hetzner Online GmbH: Hosts the mailboxes the application reads: replies to email sent from the application, and email sent to [email protected]. Data: Sender and recipient names and addresses, message content and attachments. Location: Germany (EU).
- Docusign, Inc.: Sends documents for signature, when a customer connects its own DocuSign account. Data: The documents sent for signature, and the signers’ names and email addresses. Location: United States, or the region of the customer’s DocuSign account.
- Functional Software, Inc. (Sentry): Error monitoring. Data: Technical details of errors, with account and organization identifiers; names, email addresses, request bodies and files are removed before sending. Location: United States.
Providers for our own business
These providers process information we control, such as billing details, or help us run the business without receiving customer data, as our Privacy Policy describes:
- Stripe, Inc.: Payments, subscriptions, invoices and sales tax. Data: Organization name, billing contact name and email, billing address and tax ID, payment card details (collected by Stripe directly), invoices. Location: United States.
- Hetzner Online GmbH: Hosts the enexus.cc website. Data: Website request records (IP address, browser, page requested). Location: Finland.
- Hetzner Online GmbH: Email for messages sent to our other enexus.cc addresses. Data: Contents of emails you send us. Location: Germany (EU).
- UptimeRobot: Checks from outside that the service and the website answer. Data: No customer data: only whether our public pages and health check answer. Location: Not stated by the provider.
- GitHub, Inc.: Hosts our source code. Data: No customer data: source code only. Location: United States.
Services you connect
When you or your organization choose to connect an outside service, such as Google (including Google Drive), Microsoft (including OneDrive), ArcGIS Online, Slack or a webhook address, information passes between it and the application as that feature needs. These providers act under your own agreement with them, not as our subprocessors.
Public data services
To research a site, the application sends the site’s location (and for some searches its address or parcel number) to public services of federal, state and local agencies, such as FEMA, the U.S. Fish and Wildlife Service, the U.S. Census Bureau, the U.S. Geological Survey and the Florida Department of Environmental Protection. Many agencies publish their data through hosted platforms, such as Esri’s ArcGIS Online, which receive the same request. When you type an address or place name to find a site, the text you typed is sent first to the Census Bureau’s address service and, if it finds no match, to OpenStreetMap’s Nominatim and Komoot’s Photon address search services, which run on servers in Europe. To check new passwords against known breaches, the first five characters of a one-way hash of the password are sent to Have I Been Pwned. None of these services receive names, client details or files.
How we tell you about changes
Before a new subprocessor starts processing customer data, we update this page and email the owners of every customer organization at least 30 days in advance, except in an emergency, when we give as much notice as we can. Customers may object as our Data Processing Addendum describes. To have another address notified, email [email protected].