Subprocessors
Version: 2026-08-28
Effective: 28 August 2026
LohiSoft s.r.o. uses the following processors (and notes independent controllers) to run Homnest. This list is the public Art. 13/19-style disclosure. For contract language see the DPA. For purposes and transfers see the privacy notice.
We will date this page when the list changes. Material additions will also be reflected in the privacy notice.
Infrastructure we control
| Name | Task | Personal data (typical) | Location |
|---|---|---|---|
| LohiSoft EU VPS | API, web, admin, WebSocket server | Account and AES-at-rest data; E2E ciphertext; logs | EU |
| Redis (on that VPS) | Event bus between API and WSS; presence hints for push | User and Home identifiers, event metadata — not E2E plaintext | EU |
Own SMTP (mail.homnest.eu / company mail) |
Transactional email | Email address, invitation and verification content | EU |
coturn turn1.lohisoft.com |
TURN for WebRTC | IP addresses, ephemeral HMAC credentials, relayed encrypted media (not stored as a call archive) | EU |
| Self-hosted map tiles | Render the family map | Tile requests (IP, path). Coordinates of people are not sent to a public tile CDN | EU |
No CDN sits in front of Homnest. No SMS provider.
Database and files
| Name | Task | Personal data (typical) | Location |
|---|---|---|---|
| MongoDB Atlas (MongoDB Inc.) | Primary database | All server-side collections, including E2E ciphertext fields | Frankfurt, Germany (EU) |
| Amazon Web Services — S3 | File objects | Attachments, photos, receipts, export archives (E2E objects remain ciphertext) | EU, eu-central-1 |
Notifications and stores (United States)
| Name | Role | Data | Transfer tool | Controller vs processor |
|---|---|---|---|---|
| Apple Inc. — APNs | Push to iOS | Device token; notification title/body we send (generic for E2E events) | DPF (Art. 45) if Apple is on the DPF list; otherwise Commission SCCs (Art. 46, Decision (EU) 2021/914) | Processor for delivery of our payload; independent controller for App Store billing |
| Google LLC — FCM | Push to Android | Device token; payload as above | DPF (Art. 45), Google LLC certified | Processor for FCM delivery; independent controller for Play billing |
| Apple Inc. — In-App Purchase | Merchant of record (iOS) | Payment data Apple collects; we receive entitlement fields | Apple as controller; DPF/SCC as Apple documents | Independent controller |
| Google LLC — Play Billing | Merchant of record (Android) | Payment data Google collects; we receive entitlement fields | DPF (Art. 45) | Independent controller |
We do not receive your full card number.
Not on this list
Stripe Checkout, PostHog, Sentry, Cloudflare, Twilio, Google Analytics, Meta pixels, and similar tools are not used in Homnest as shipped.
Contact
hello@lohisoft.com — LohiSoft s.r.o., Štúrovo, SK. No DPO appointed.
Version 2026-08-28.