Sub-processors
Effective: 2026-06-22 · Version v2026.06.22
Under Article 28(2) GDPR we maintain this list of sub-processors. Customers are notified of material changes at least 30 days in advance, via email to the billing contact and via an in-app banner to organisation administrators.
Current sub-processors
| Sub-processor | Purpose | Data categories | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe Ltd | Payment processing, subscription management | Email, billing address, payment method, invoice history | Ireland (onward US transfers) | SCCs + EU-US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error tracking and performance diagnostics | Error traces, limited user identifiers (scrubbed) | United States | SCCs |
| New Relic, Inc. | Application performance monitoring | Request metadata, error traces | United States | SCCs |
| Hetzner Online GmbH | Infrastructure hosting, storage, compute | All data at rest | Finland (EU) | No transfer - EEA |
| Proton AG (Proton Mail) | Transactional email delivery | Email addresses, email content (verification, notifications) | Switzerland | Commission adequacy decision (2024/2696) |
IP geolocation and ASN enrichment run in-process against locally-hosted MaxMind-format databases (GeoLite2, plus a country-ASN database downloaded from IPInfo to our EEA infrastructure). Lookups are performed locally; no end-user IP address is transferred to MaxMind or IPInfo, so neither is a sub-processor for this purpose.
Change notification
When we propose to add or replace a sub-processor, we:
- Post a banner to organisation administrators in-app for 30 days before the change takes effect
- Email the billing contact of every organisation
- Commit the change to this document in our public repository
Right to object
Customers may object to a proposed sub-processor within 30 days of notification by emailing [email protected]. If we cannot accommodate a reasonable objection, we will work in good faith to find an alternative. If none is viable, the customer may terminate the affected subscription without penalty and request deletion or return of their data per our DPA.