| Vendor | Category | Location | Scope of processing | Since | Legal basis |
|---|---|---|---|---|---|
| Amazon Web Services | Edge & hosting | Global (eu-west-1 default) | Edge resolver, dashboard hosting, S3 logs | 2022 | AWS DPA + SCCs |
| Cloudflare | Edge & DNS | Global | Edge POPs, DNS, DDoS protection | 2022 | Cloudflare DPA + SCCs |
| Stripe | Billing | United States, Ireland | Payment processing, invoicing | 2022 | Stripe DPA + SCCs |
| Sentry | Error monitoring | European Union | Application error capture (stack traces only) | 2023 | Sentry DPA |
| PostHog Cloud EU | Product analytics | European Union | First-party dashboard usage analytics | 2024 | PostHog DPA |
| Vercel | Marketing site | Global | Marketing site hosting (no customer data) | 2022 | Vercel DPA |
| Loops | Transactional email | United States | Account emails, password resets, invoices | 2023 | Loops DPA + SCCs |
| Linear | Internal support | United States | Support ticket pipeline (no end-user data) | 2022 | Linear DPA + SCCs |
30-day notice
We email account admins and post here before any new sub-processor begins handling your data.
Right to object
If you object to a new sub-processor, you can terminate paid plans without penalty before they go live.
EU data residency
Pin click + account data to EU regions on Growth and above. Edge POPs still serve globally; storage stays put.