Sub-processors
Three companies process data on our customers' behalf. This list is the one the data processing agreement refers to; a change to it is announced here and by email to account holders thirty days before it takes effect.
| Sub-processor | What it does | What it sees | Where |
|---|---|---|---|
| Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA | Hosts the service: compute, the storage each project lives in, image storage, backups, request logs | Everything in a project, pinned to EU locations; request logs including IP addresses | Project data in the European Union. Cloudflare is certified under the EU–US Data Privacy Framework and our agreement includes the standard contractual clauses. |
| Clerk, Inc. — 660 King St, San Francisco, CA 94107, USA | Sign-in for the console, where the account holder manages the organisation and its subscription | The account holder's name, email address and organisation. Nothing inside a project. | United States. Certified under the EU–US Data Privacy Framework; standard contractual clauses signed. |
| Stripe Payments Europe, Ltd. — 1 Grand Canal Street Lower, Dublin 2, Ireland (with Stripe, Inc., USA) | Payment for the Team plan, invoicing, VAT calculation, the billing portal | The account holder's billing address, VAT number and card details, which we never see in full. Nothing inside a project. | Ireland; some processing by Stripe, Inc. in the United States under the Data Privacy Framework and standard contractual clauses. |
No other party processes customer data. There is no analytics provider, no email marketing tool and no support desk vendor; support email is read in an ordinary mailbox we operate.
What is deliberately not on this list
Anyone the customer gives a link to. A person or a coding agent holding a project link reads and writes in that project on the customer's instruction, not ours. They are the customer's users, not our sub-processors.
History
- 2026-08-27 — first published: Cloudflare, Clerk, Stripe.