Draft for review. Have a UK solicitor check this document before launch.
Sub-processors
Effective
We use the providers below to run . Each processes personal data only on our instructions under a written contract with appropriate safeguards. None of them receive your firewall configurations: those are analysed only in your browser.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. | Sign-in, database and server functions | Account, company, plan, usage metadata, device labels and fingerprints, accepted risks, sign-offs, messages and reports you send us | Hosted in |
| Cloudflare Inc. | Website hosting, content delivery, protection from attacks, and cookie-free visitor statistics for the public pages (Cloudflare Web Analytics) | IP address and browser details in short-lived logs | Global network |
| Paddle.com Market Ltd | Reseller and merchant of record: checkout, payments, tax and invoices | Billing name, email, address, VAT number and payment details (independent controller) | UK, with processing in the EU and US |
| Resend Inc. (if enabled) | Sending account, invitation and reminder emails | Recipient email address and email content | US / EU |
Changes
We’ll update this page before we add or replace a sub-processor. Business customers with a data processing agreement get at least 30 days’ notice by email and may object on reasonable grounds, as the agreement explains. To be added to the notification list, email .