We notify customers at least 30 days before adding or changing a sub-processor. Subscribe to the Atom feed or watch the policy repository on GitHub.
Infrastructure
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services, Inc. | Compute, storage, networking | Frankfurt (eu-central-1), Dublin (eu-west-1), Virginia (us-east-1) | SCCs · DPF |
| Cloudflare, Inc. | DNS, edge cache, WAF | Global edge | SCCs · DPF |
| Hetzner Online GmbH | Build infrastructure and SBOM signing | Falkenstein, Germany | n/a (EU) |
Operations & support
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| GitHub, Inc. | Source code, issue tracking, releases | USA | SCCs · DPF |
| HelpScout, Inc. | Customer support ticketing | USA | SCCs · DPF |
| Stripe Payments Europe Ltd. | Payment processing | Ireland; failover USA | SCCs · DPF |
| Twilio SendGrid | Transactional email | USA | SCCs · DPF |
Optional (Enterprise tier only, by opt-in)
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Microsoft Azure | Sovereign-cloud regions for IL4-class workloads | Customer-selected sovereign region | SCCs · in-region |
| Google Cloud Platform | HIPAA-eligible regions for regulated pharma customers | Customer-selected region | SCCs · DPF |