Sub-processors
Every third party that processes customer data on our behalf. The list is short on purpose, and we will give notice here before adding to it.
Last updated 2026-09-04
| Sub-processor | Purpose | Location | Data | Status |
|---|---|---|---|---|
| Amazon Web Services | Hosting: compute, database, object storage, cache | eu-central-1 (Frankfurt). Contracted through AWS India (AISPL). | All customer data | live |
| Amazon SES | Transactional email: invitations, password resets, verification | SES region, being pinned before launch | Email addresses and names | live |
| Amazon CloudWatch | Application logs, 7-day retention | eu-central-1 (Frankfurt) | Log lines carrying tenant, user and correlation identifiers | live |
| Sentry | Error tracking | Region not yet pinned. Pinning an EU region is a pre-launch item. | Stack traces and identifiers. Personal data is scrubbed at source. | live |
| Google Workspace | Company email and documents | Google's regions | Whatever you send us by email | live |
| Razorpay | Payments | India | Billing contact and payment metadata. No card data touches our systems. | not yet live |
| Uptime and status provider | External synthetics and the public status page | To be decided | No customer data. Probes public endpoints. | not yet chosen |
Emission factor publishers are not sub-processors
DESNZ, the EPA, ADEME, IPCC, Ember, USEEIO and the rest publish datasets that we download, parse and serve. Data flows to us. None of your data reaches them, and none of them processes anything on our behalf, so they do not belong on this list even though they are named all over the product.
Where this list is still moving
Three rows are not settled, and we would rather show them than tidy them away. Sentry’s data region is not yet pinned to the EU, which is a pre-launch item. The uptime and status provider has not been chosen. Razorpay is contracted but payments are not yet live. Amazon SES sends from a region we are pinning explicitly rather than inheriting.
Our AWS capacity is contracted through AWS India (AISPL) while the infrastructure itself runs in eu-central-1. That distinction matters to a data protection officer, so it is stated rather than simplified.