Subprocessor list
Third parties that process personal data on our behalf (GDPR Art. 28). A change to this list flows through to the privacy policy.
| Provider | Country / region | Purpose of processing | Transfer mechanism | DPA |
|---|---|---|---|---|
| Render | United States (Frankfurt deployment region) | Backend API hosting + Postgres database | SCC (EU Standard Contractual Clauses) | DPA |
| Cloudflare R2 | European Union region | DXF file storage + invoice PDFs | EU region — no cross-border transfer | DPA |
| Stripe | Ireland (data centre) / United States (parent) | Payment processing + receipt issuance | SCC + EU-US Data Privacy Framework | DPA |
| Resend | United States | Transactional email delivery (magic-link, receipts) | SCC | DPA |
| Sentry | United States | Error monitoring (gated by analytics consent — see /privacy) | SCC | DPA |
| Vercel | United States | Frontend (storefront, admin) hosting + edge cache | SCC + EU-US Data Privacy Framework | DPA |
| ARES (CZ public registry) | Czech Republic | Company-data lookup by IČO (public registry — not a processor) | Public registry; no PII transfer | DPA |
Last updated 2026-08-22