Hugo & Friends AB · 559555-9989
The current ProxyAPI provider chain.
Core Operations
ProxyAPI’s core database, control plane, and backups are operated by Hugo & Friends AB on our own hardware in Sweden. The table distinguishes subprocessors in service delivery from other recipients such as payment providers.
Customer-operated agents: When a customer connects its own ProxyAPI agent, that node is under the customer’s control and is not a ProxyAPI subprocessor. Any third-party-operated exits are covered by the provider list or a separate customer agreement.
Current Provider List
| Provider | Classification | Purpose | Data | Location | Applies when |
|---|---|---|---|---|---|
| Cloudflare, Inc. ↗ | Subprocessor / infrastructure | DNS, web hosting (Pages), security edge, control-plane tunnel, and R2 for agent releases. | IP address, request and security metadata, web traffic, and release objects. The proxy traffic data path does not run through Cloudflare Pages. | Global edge network; region according to enabled service and configuration. | Website, dashboard/API edge, DNS, and agent distribution |
| GleSYS AB ↗ | Subprocessor / Swedish edge | Primary proxy-endpoint ingress, TLS to ingress, and onward transport over private networking. | Source IP, network metadata, and encrypted/tunnelled traffic passing through the infrastructure. | Sweden | Proxy connections through primary ingress |
| Bahnhof AB ↗ | Subprocessor / Swedish backup edge | Backup proxy-endpoint ingress and related network transport. | Source IP, network metadata, and encrypted/tunnelled traffic when the backup path is used. | Sweden | When backup ingress is used |
| Tailscale Inc. ↗ | Subprocessor / private network | Encrypted mesh network between ingress, core platform, exits, and administrators. | Device, identity, network, and connection metadata; tunnel traffic is end-to-end encrypted between nodes. | According to Tailscale’s DPA and service architecture | Internal operations and data path between nodes |
| Mailgun Technologies, Inc. ↗ | Subprocessor / email | Transactional email for sign-in, account, billing, and operational notices. | Email address, message content, and delivery metadata. | EU endpoint is used | When the system sends email |
| IPRoyal Services FZE LLC ↗ | Subprocessor / upstream proxy | Upstream datacenter and ISP proxy capacity. | Destination host/port, network metadata, and tunnel traffic routed through the selected exit. HTTPS content is encrypted between client and destination. | Exit location varies; the provider is established in the United Arab Emirates. | When an IPRoyal exit is selected |
| Stripe Payments Europe, Limited ↗ | Payment provider / recipient | Card payments, subscriptions, and payment-related fraud controls. | Contact, billing, and payment details plus customer and subscription references. | According to Stripe’s terms and service architecture | Paid plans using Stripe |
Changes and Objections
Material additions or replacements covered by the DPA are published here and normally communicated by email or dashboard at least 30 days before the provider begins processing customer data. During that period, the customer may make a reasonably substantiated data-protection objection under the DPA.