Sub-processors
Cloudflare, Inc. Network, security, form bot checks and AI inferenceGlobal edge
Core product
WorkOS, Inc. Sign-in and single sign-on (SSO)United States
Core product
Amazon Web Services, Inc. Cloud infrastructure beneath the database (through Neon)United States
Core product
Anthropic, PBC Internal productivity toolsUnited States
Internal tools
Google LLC Business email and documentsMulti-region
Internal tools
Neon, Inc. Managed databaseUnited States
Core product
Nango (only when a customer connects an integration via OAuth) Authorization for integrations a customer connectsUnited States
Optional integrations
Vercel, Inc. Web hosting, and analytics where the Cookie Policy allowsMulti-region edge
Core product
Sentry (Functional Software, Inc.) Error trackingUnited States
Monitoring
Resend, Inc. Transactional emailUnited States
Core product
UptimeRobot Availability monitoringMulti-region
Monitoring
GitHub, Inc. Source control, continuous integration and encrypted backupsUnited States
Engineering and backups1-12 of 12 resultsRead from the Sub-processor List, last updated October 17, 2026.
Abbreviations used in the Trust Center
- AES
- Advanced Encryption Standard
- AI
- artificial intelligence
- API
- application programming interface
- APRA
- Australian Prudential Regulation Authority
- AWS
- Amazon Web Services
- BAA
- business associate agreement (HIPAA)
- CAIQ
- Consensus Assessments Initiative Questionnaire (Cloud Security Alliance)
- CCPA
- California Consumer Privacy Act
- CISA
- Cybersecurity and Infrastructure Security Agency (United States)
- CPRA
- California Privacy Rights Act
- CSA
- Cloud Security Alliance
- CSF
- Cybersecurity Framework (NIST)
- CPS
- Cross-Industry Prudential Standard (APRA)
- DORA
- Digital Operational Resilience Act (European Union)
- DPA
- data processing agreement
- DPDP
- Digital Personal Data Protection Act (India)
- DPIA
- data protection impact assessment
- DSS
- Data Security Standard (PCI)
- EU
- European Union
- FTC
- Federal Trade Commission (United States)
- GDPR
- General Data Protection Regulation (European Union)
- HIPAA
- Health Insurance Portability and Accountability Act
- HSTS
- HTTP Strict Transport Security
- HTTP
- Hypertext Transfer Protocol
- HTTPS
- HTTP over TLS
- ICT
- information and communication technology
- IEC
- International Electrotechnical Commission
- ISO
- International Organization for Standardization
- LLC
- limited liability company
- NDA
- non-disclosure agreement
- NIS
- Network and Information Security Directive (European Union)
- NIST
- National Institute of Standards and Technology (United States)
- NYCRR
- New York Codes, Rules and Regulations
- NYDFS
- New York State Department of Financial Services
- PBKDF2
- Password-Based Key Derivation Function 2
- PCI
- Payment Card Industry
- PIPEDA
- Personal Information Protection and Electronic Documents Act (Canada)
- RMF
- Risk Management Framework (NIST)
- SHA
- Secure Hash Algorithm
- SIG
- Standardized Information Gathering questionnaire (Shared Assessments)
- SOC
- System and Organization Controls (AICPA)
- SP
- Special Publication (NIST)
- STAR
- Security, Trust, Assurance and Risk registry (Cloud Security Alliance)
- TLS
- Transport Layer Security
- TOTP
- time-based one-time password
- URL
- web address (uniform resource locator)