Subprocessors

About this list

A subprocessor is a company we use to help deliver the service that may process personal data in the process. We keep this list deliberately short — the whole differentiator is that your data touches very few companies.

We maintain this list as a single source of truth, so it can't drift between this page, our security page, and our DPA. We'll give notice before adding or replacing a subprocessor.

Cloudflare, Inc.Core

Hosting, edge compute (Workers), database (D1), object storage (R2), CDN & DNS.

Data: Account data, Application data, IP addresses (transient), Request logs

EU region where available (configurable per deployment)

DPA ↗

Polar Software, Inc.Core

Payments, subscriptions & invoicing (merchant of record).

Data: Billing contact, Email, Payment metadata (no raw card data)

United States / EU

DPA ↗

Analytics host (self-hosted Umami)Optional

Cookieless, first-party product analytics. No data leaves your infrastructure.

Data: Pseudonymous page/event data (no cookies, no cross-site tracking)

Same region as the app (self-hosted)

Questions about a subprocessor?

Ask us anything, or request notice of changes.