Last updated September 2026
Our Data Processing Addendum commits us to publishing the subprocessors we engage and to giving notice before we add one. This page is that list. It also draws a line that matters for billing infrastructure: the payment providers you connect are engaged by you, under your own credentials and your own agreement with them, and are not our subprocessors.
A subprocessor is a third party we engage that processes personal data on our behalf to deliver the Service to you. It does not include a provider you contract with directly and connect to the Service yourself, even when we send instructions to it on your behalf.
Vercel Inc. (United States) hosts our marketing website and serves it over its CDN. Processing is limited to standard request delivery and server logs.
Application hosting, managed database, and object storage are provided by our cloud infrastructure providers, which process customer data at rest and in transit as part of running the platform. The current provider list, with regions, is available on request at support@subinclabs.com and is provided as part of DPA diligence.
Transactional email — invoices, receipts, dunning reminders, notifications — is sent through the provider configured for your account. Depending on that configuration this is your own SMTP relay, SendGrid, Amazon SES, Postmark, or Mailgun. Where you configure your own relay, we are not engaging a subprocessor on your behalf; where the platform default is used, the provider above acts as our subprocessor.
SMS is off by default. Where an account enables it, messages are sent through Twilio Inc. (United States). One-time codes are never written to logs.
Payment gateways and payout rails — including Stripe, Adyen, Braintree, Wise, and others we support — run under credentials you supply and are governed by your agreement with that provider. They are your processors, not ours. We instruct them on your behalf; we do not hold the relationship, and adding or removing one is your decision rather than a change to this list.
We give notice before adding a subprocessor that processes customer personal data, and you may object on reasonable data-protection grounds as set out in the DPA. The date at the top of this page changes whenever the list does.
Questions about this document: support@subinclabs.com