Subprocessors
Last updated: 2026-09-26
1. What is a subprocessor?
A subprocessor is an external service we use to help deliver Klyrix. Each one is contractually bound to keep your data confidential, to apply security controls equivalent to ours, and to honour international-transfer mechanisms such as EU Standard Contractual Clauses.
2. Notification policy
Before adding a new subprocessor we publish the change here and notify customer administrators by email at least 30 days in advance. Customers may object during this window; if the objection cannot be resolved we will, as a last resort, allow termination of the affected service line with pro-rata refund.
3. Current list
| Subprocessor | Service | Region | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Hosting, CDN, Edge runtime | USA (primary) + EU edge | EU SCCs + Data Privacy Framework (DPF) |
| Supabase Inc. | Postgres database, Auth, Realtime, Storage | eu-central-1 (Frankfurt, EU) | EU SCCs (EU↔UAE); intra-EEA storage |
| Stripe Payments Europe Ltd. | Payment processing, invoicing, tax | EU (Ireland) + global processors | EU SCCs (intra-EEA for EU customers; SCC for UAE) |
| Resend Inc. | Transactional email | USA | EU SCCs + DPF |
| Cloudflare Inc. | DNS, WAF (optional), bot management | Global edge | EU SCCs + DPF |
| Contabo GmbH | Cold storage (S3) — backups | EU (Germany) | Intra-EU |
| Sentry (Functional Software, Inc.) | Error monitoring, performance traces | USA + EU region available | EU SCCs + DPF |
| Telegram (optional) | Operator alerts | Global | Explicit consent |
| ip-api.com | IP geolocation lookup — the public IP address of a WireGuard VPN client connection; the returned location is shown in the admin console | Not yet documented | Not yet documented — under legal review |
| OpenAI, L.L.C. | Optional AI features (not active at general availability) | USA | EU SCCs + DPF — enabled only with customer opt-in |
ip-api.com is the exception to the commitments in section 1: its contractual basis and processing location are not yet documented and are under legal review. How the lookup is sent is described as flow F10 on the data flow page.
4. Subscribe to notifications
Email privacy@klyrix.com with the subject line "Subprocessor notifications" and we will add you to the announce list. A public RSS feed is on the roadmap.
5. Historical changes
| Date | Change |
|---|---|
| 2026-05-21 | Initial subprocessor list published. |
| 2026-09-26 | List corrected to the flows measured in the platform code: added Contabo GmbH (backups), Telegram (optional operator alerts) and ip-api.com (VPN connection location lookup), which the platform already used but this list omitted. |
Related: DPA · Privacy Notice · Trust Center.