Legal
Subprocessors
The companies we rely on to run the platform, and what each one does with personal data. The first table is the list Annex 3 of the Data Processing Addendum refers to.
We use as few providers as we can. Each of these processes customer data only to do the job listed, under a contract with Assessly Pte. Ltd. with data protection terms at least as protective as our DPA. Where a provider processes data outside Singapore, that contract binds it to protect the data to a standard comparable to Singapore's Personal Data Protection Act 2012.
| Subprocessor | What it does for the Service | Data it sees | Location |
|---|---|---|---|
| Cloudflare, Inc. San Francisco, USA |
Hosting and the edge network. Runs the edge that authenticates every request, the applications themselves (Workers and containers), their storage (files, databases, container images), the control plane behind the dashboard and the API, the queue that carries audit events, and the audit-log archive. | Everything that passes through the platform: request metadata, identity tokens, application code and data, the audit stream in transit, and most audit-log entries older than 30 days, encrypted with a key that belongs to the workspace. | Requests are served from Cloudflare's global edge, at the location nearest the person making them. The control plane runs in the Asia-Pacific region. The audit-log archive is kept in R2, which Cloudflare is asked to keep in the Asia-Pacific region. Each app's database and files are made in the Cloudflare region nearest where the person who created the app was, as a hint Cloudflare follows where it can. They stay where they were made. |
| Neon, LLC USA |
The control-plane database (Postgres): accounts, workspaces, members, app configuration, access rules, encrypted secrets, billing status, and the audit log, apart from most entries older than 30 days, which move to the audit-log archive at Cloudflare. | Account emails, sign-in metadata, app metadata, secrets in encrypted form, and the audit log, apart from most entries older than 30 days. | AWS ap-southeast-1 (Singapore). |
| Plus Five Five, Inc., which trades as Resend San Francisco, USA |
Transactional email, and nothing else: sign-in codes; invitations to a workspace or an app; notices that a Google or Microsoft account, or a passkey, can now sign someone in, or that their company sign-in signed them in to restore a deleted workspace; notices that an account was deleted; notices to a workspace's owners about its billing, its request allowance, a suspension, audit-log entries due to be deleted, or a change to the Service; notices about a workspace's database limit and database rows; notices about files kept past a workspace's storage, or key-value data kept on a plan without it; notices that a workspace's SCIM token is about to stop working or has to be replaced after a restore; notices to a workspace's owners that it was deleted, deleted for good or restored; requests for access to an app, to the people who can grant it, and summaries of the people a workspace's apps turned away; notices about a workspace's usage: its allowances, usage charges, usage limit, invoices during a billing month and credits; notices that a workspace webhook, Slack channel, audit log stream or log drain was added, turned back on or given more events, or was turned off after a day of failed deliveries; notices that we closed an app's public path because its files would have answered there before its code; a weekly summary of a workspace for its owners, which each owner can unsubscribe from; updates to people who subscribe to the status page, and the link that confirms a subscription; and alerts to our own staff when part of the platform goes down or comes back, when our status checks stop reporting, when audit-log entries aren't being delivered, when mail fails to send, when a deleted app is still on Cloudflare an hour later, when Cloudflare won't let us read apps' logs, when usage metering needs a look, when a release skips its wait on staging or a nightly test fails, or when our staff change something in a customer's account. | The recipient's email address and the content of the message. | Sent from ap-northeast-1 (Tokyo), Japan. Also processed in the United States. |
| Proton AG Geneva, Switzerland |
Our own mailboxes: support, privacy, security, legal, abuse and the data protection officer. It holds the email you send us, replies to the platform's emails included, and our answers. | Whatever you write to us: your email address and name, and anything you include, such as a workspace or app name, the address an app was shared with, or lines from the audit log. Kept 2 years after the last message in the thread. | Switzerland, Germany or Norway, where Proton stores mail. |
Providers that hold only our own data
Stripe processes no customer data. It handles billing data, which we hold as controller, as the Privacy Policy describes. We give the same 30 days' notice before we add or replace a provider here.
| Provider | What it does for the Service | Data it sees | Location |
|---|---|---|---|
| Stripe Payments Singapore Pte. Ltd. Singapore |
Payments: subscriptions, cards, invoices, receipts, tax calculation, and the customer portal where a card is updated, an invoice is read or a plan is cancelled. It is the Stripe company we contract with. Stripe, Inc., of South San Francisco, USA, does the processing for it. | The workspace owner's email address and the workspace name, which we give Stripe as the customer's email and name, until a billing name entered at Stripe's checkout replaces the name. The hourly counts we report for metering, of requests, CPU time, database rows and database storage. And what you give Stripe yourself: billing name and address, card details, tax identifiers and invoice history. We never receive your card details. The workspace identifier is in the customer's metadata. | United States. |
When the list changes
We email every workspace owner at least 30 days before we add or replace a subprocessor, saying what it will do and where. If you object on reasonable data protection grounds, section 7 of the DPA says what happens next. Removing a subprocessor needs no notice. We update the list when it happens.
The date at the top of this page is the date of the last change to the list.
What is not on the list
No analytics provider or advertising network is on the list. No customer-relationship tool holds your data, and no service reads your content for any purpose of its own. GitHub hosts the open-source SDKs and the CLI’s releases, but no customer data goes there. Deploy scans look up the public packages a project’s lock files name in OSV (osv.dev), Google’s open vulnerability database. It gets each package’s name and version and nothing else: not your code, your file names, or who deployed.
Some providers are ones you or your workspace choose to use, and they are not our subprocessors. Data goes to them because you set it up, under your own terms with them:
- Google and Microsoft, when you sign in with them.
- Your workspace's own identity provider, for single sign-on and SCIM.
- GitHub, when a workspace deploys from its own repository.
- Anthropic and OpenAI, when a workspace stores its own key and its apps send requests through our outbound proxy.
- The webhooks, Slack channels and audit log streams, such as a SIEM, that a workspace sends its events to.
The providers your apps call are your own subprocessors, not ours, even where the platform holds their credentials for you.