Trust
Subprocessors
The companies we rely on to run ConsentCook, what each one does, and where it sits.
| Name | Purpose | Location | Role |
|---|---|---|---|
| Amazon Web Services (eu-west-1/2) | Application and database hosting | EU (Ireland/London) | processor |
| Cloudflare | CDN delivery of signed configuration and the loader | Global edge | processor |
| PostgreSQL managed instance (RDS) | Consent receipt and configuration storage | EU (Ireland) | processor |
| S3-compatible object storage | Scan artefacts and exportable evidence reports | EU (Ireland) | processor |
How we work out a visitor’s country
To show the right consent choices, ConsentCook needs to know roughly where a visitor is. We work that out on our own servers by looking their IP address up in a database we hold locally — the address is never sent to anyone else, and we do not store it.
That database is IP Geolocation by DB-IP, used under CC BY 4.0. DB-IP is not a subprocessor and receives no data from us.