Subprocessor list
Third parties that process personal data on our behalf (GDPR Art. 28). A change to this list flows through to the privacy policy.
| Provider | Country / region | Purpose of processing | Transfer mechanism | DPA |
|---|---|---|---|---|
| Render | United States (Frankfurt deployment region) | Backend API hosting + Postgres database | SCC (EU Standard Contractual Clauses) | DPA |
| Cloudflare R2 | European Union region | Uploaded production file storage (e.g. DXF, STL) + invoice PDFs | EU region — no cross-border transfer | DPA |
| Cloudflare Turnstile | United States (global edge network) | Signup form bot protection — visitor IP address and technical data | SCC | DPA |
| Stripe | Ireland (data centre) / United States (parent) | Payment processing + receipt issuance | SCC + EU-US Data Privacy Framework | DPA |
| Resend | United States | Transactional email delivery (magic-link, receipts) | SCC | DPA |
| Ireland (Google Ireland) / United States (parent) | Sign in with Google when the user chooses it (identity provider — acts as an independent controller) | SCC + EU-US Data Privacy Framework | DPA | |
| Sentry | United States | Error monitoring (gated by analytics consent — see /privacy) | SCC | DPA |
| Better Stack | United States | Uptime monitoring, public status page + incident records (operational data and status-page visitor technical data) | SCC + EU-US Data Privacy Framework | DPA |
| Vercel | United States | Frontend (storefront, admin) hosting + edge cache | SCC + EU-US Data Privacy Framework | DPA |
| ARES (CZ public registry) | Czech Republic | Company-data lookup by IČO (public registry — not a processor) | Public registry; no PII transfer | DPA |
Last updated 2026-09-06