Sub-processors
Every third party that processes customer data on our behalf. The list is short on purpose, and we will give notice here before adding to it.
Last updated 2026-09-13
| Sub-processor | Purpose | Location | Data | Status |
|---|---|---|---|---|
| Amazon Web Services | Hosting: compute, database, object storage, cache | eu-central-1 (Frankfurt). Contracted through AWS India (AISPL). | All customer data | live |
| Amazon SES | Transactional email: invitations, password resets, verification | eu-central-1 (Frankfurt), pinned explicitly | Email addresses and names | live |
| Amazon CloudWatch | Application logs, 14-day retention | eu-central-1 (Frankfurt) | Log lines carrying tenant, user and correlation identifiers | live |
| Sentry | Error tracking, for the application and the browser | European Union (Germany). The organisation was created in Sentry’s EU data region, which cannot be changed afterwards. | Stack traces, a tenant identifier and a correlation identifier. No email, no name, no cookies, no HTTP request or response bodies, and no session replay: every collection category is switched off explicitly and a scrubber removes anything sensitive the application adds. | live |
| Mixpanel | Product analytics, for people who have opted in | European Union (Netherlands). The project was created with EU data residency, which cannot be changed afterwards. | Event names from a fixed list, counts and durations, an opaque user identifier and an opaque tenant identifier. No email, no name, no company name, and geolocation is switched off. Nothing is sent unless you have granted analytics consent, which is checked on our own servers on every request and can be withdrawn at any time. | live |
| Google Workspace | Company email and documents | Google's regions | Whatever you send us by email | live |
| Razorpay | Payments | India | Your company name, billing contact and the amount, entered on Razorpay’s own payment form; we receive payment metadata and identifiers back. Card details never touch our systems. | live |
| Uptime and status provider | External synthetics and the public status page | To be decided | No customer data. Probes public endpoints. | not yet chosen |
Emission factor publishers are not sub-processors
DESNZ, the EPA, ADEME, IPCC, Ember, USEEIO and the rest publish datasets that we download, parse and serve. Data flows to us. None of your data reaches them, and none of them processes anything on our behalf, so they do not belong on this list even though they are named all over the product.
Where this list is still moving
One row is not settled, and we would rather show it than tidy it away: the uptime and status provider has not been chosen. Everything else on the list is in use. Sentry and Mixpanel are on their EU-region instances, and the code refuses a non-EU address at start-up. Razorpay processes card payments from its own form, so card details are never on our systems. Amazon SES is pinned explicitly to eu-central-1 rather than inherited, and the domain is verified there.
Our AWS capacity is contracted through AWS India (AISPL) while the infrastructure itself runs in eu-central-1. That distinction matters to a data protection officer, so it is stated rather than simplified.