Sub-Processor List
Sub-processors used to process personal data on behalf of customers.
| Name | Purpose | Location | Transfer mechanism | Added on |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, edge compute, DDoS protection | USA (DPF certified) + EU edge | EU-US Data Privacy Framework + SCCs (fallback) | 2026-03-18 |
| Paddle.com Market Ltd | Merchant of Record — billing, VAT, payments, invoicing | United Kingdom | UK adequacy (Commission Implementing Decision (EU) 2021/1772) | 2026-03-18 |
| Functional Software, Inc. (Sentry) | Error monitoring and performance telemetry | USA (DPF certified) | EU-US Data Privacy Framework + SCCs (fallback) | 2026-04-18 |
| Ory Corp | Identity and authentication (Kratos) — email, MFA, sessions | Germany (EEA) | EEA — no third-country transfer | 2026-04-18 |
Per DPA §5, we notify customers of any changes with at least 30 days advance notice.