Sub-Processors
Vulos publishes an operating system and a suite of open-source apps. You run them on hardware you own or rent. We operate no service that holds your data, so there is nothing for a sub-processor to process — and therefore no sub-processor list for user data. This page discloses the only third parties that genuinely exist: the host of this website and the host of the source code.
We hold none of your data.
A sub-processor is a third party that handles personal information on our behalf. That relationship needs us to hold the data first. We do not: your files, mail, calendar, keys and AI context live on your own machine and are never sent to us. Where your box needs storage, compute or backups, you choose that provider and contract with them directly — they answer to you, not to us. See data processing for what that means in practice.
Third parties involved in this website
| Service | What it does | Data involved | Where |
|---|---|---|---|
| Fly.io | Serves this website. The site is a folder of static files behind nginx — no database, no API, no accounts, no logins. | Ordinary web-server request logs: IP address, the page requested, browser user-agent. Nothing from anyone’s Vulos box. | Johannesburg (jnb) |
| GitHub | Hosts the source code, the issue tracker and the release downloads for the OS and its apps. | Whatever you send GitHub yourself by browsing, cloning, filing an issue or downloading a release. That exchange is between you and GitHub. | GitHub’s own infrastructure |
That is the whole list. This website loads no analytics, no trackers, no advertising tags, no third-party fonts and no embedded widgets. It sets no cookies; your theme choice is kept in your own browser’s local storage and is never sent anywhere.
Reachability
The default relay is your own software, not a third party
To reach your box from anywhere, Vulos routes by default through the built-in Vulos relay — a role of the same open-source binary, run by you on a box with a public IP. It forwards an encrypted stream between your browser and your box; it holds no keys and cannot read what passes through it. Because you operate it, it is not a third-party subprocessor at all.
You choose the route — or none
You can run your own relay nodes, reach your box directly over a static IP or your own domain, or point at an experimental broker such as Pier (an open-source broker in the Kotva ecosystem — hosted by us, self-run, or someone else’s). Switching is a configuration change: no migration, no account, no lock-in. Source at github.com/vul-os/pier.
Questions about this page
If a third party is ever added to the list above, it appears here. For anything about data and privacy, email privacy@vulos.org. Related: data processing · privacy and POPIA · how the software handles data.