Sub-processors
This list is referenced from the Privacy Policy and the Data Processing Agreement. It is updated when a sub-processor is added, removed, or replaced. Changes affecting end-user data trigger the 30-day notification described in data-processing-agreement.md, section 7.
| Sub-processor | Purpose | Location | Data involved | Transfer mechanism | DPA link |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Edge compute (Workers), key-value cache (KV), database (D1), request analytics (Analytics Engine), bot/abuse challenge (Turnstile) | Global edge network; [CONFIRM: whether EU-only data residency is configured for this account] | Hashed email address and domain (cache), API key hash, IP address, Origin header, user agent |
Cloudflare Data Processing Addendum; Standard Contractual Clauses for transfers outside the EEA; EU-U.S. Data Privacy Framework self-certification where applicable, status to confirm at publication | [CONFIRM: link to Cloudflare's current DPA, typically https://www.cloudflare.com/cloudflare-customer-dpa/, verify current URL before publication] |
| Polar.sh | Merchant of record: checkout, subscription billing, invoicing, VAT handling, usage metering | [CONFIRM: Polar's country of establishment/domicile] | Customer (account holder) name, billing address, payment metadata; no card data | [CONFIRM: transfer mechanism per Polar's own DPA and privacy policy] | [CONFIRM: link to Polar's DPA, see https://polar.sh/legal at time of publication] |
| Verifalia S.r.l. | Email deliverability verification, paid slow-path only, invoked only when a customer's request opts into deliverability checking with a secret key | Italy (EU) | Plaintext email address submitted for verification | Intra-EU, no additional transfer mechanism needed if Verifalia is the provider used | [CONFIRM: link to Verifalia's DPA] |
| Clearout | Alternative/fallback email deliverability verification provider, paid slow-path only | [CONFIRM: Clearout's country of establishment] | Plaintext email address submitted for verification | [CONFIRM: transfer mechanism if Clearout is used instead of, or alongside, Verifalia] | [CONFIRM: link to Clearout's DPA] |
| Google LLC / Google Ireland Limited | Google Analytics 4, website analytics, consent-gated, routed through a first-party server-side gateway | United States (Google LLC) and/or EU (Google Ireland Limited) depending on configuration | Pseudonymous website usage data, collected only after cookie consent | Google's EU-U.S. Data Privacy Framework self-certification; [CONFIRM: current status and which Google entity is the data importer for this account] | [CONFIRM: link to Google Ads/Analytics data processing terms, https://business.safety.google/adsprocessorterms/ or the current equivalent] |
| Google Workspace | Account and support email, calendar, internal documents | [CONFIRM: data location configured for the Workspace tenant] | Correspondence content with account holders and prospects | Google Workspace Data Processing Amendment; EU-U.S. Data Privacy Framework self-certification where applicable | [CONFIRM: link to Google Workspace DPA] |
Note on provider selection. The deliverability verification provider (Verifalia or Clearout) is not yet finalised per the architecture notes reviewed for this draft (docs/email-rating-saas-architecture-notes.md). Both are listed here as candidates; remove the one not selected once the decision is made, and update the DPA and privacy policy sub-processor references accordingly.