Subprocessors
- Last updated 12 August 2026
- About 3 minutes to read
- Applies worldwide
How to read this
A subprocessor is a company we use that may touch personal data you entrust to us. Every one below is bound by a written data processing agreement with confidentiality duties, security obligations, and — where data leaves the EEA or UK — Standard Contractual Clauses plus the UK International Data Transfer Addendum.
This list covers our own operations. Vendors chosen for a specific client project are listed in that project's agreement instead, and the last section shows the ones we recommend most often.
Infrastructure
| Provider | Purpose | Data location | Transfer basis |
|---|---|---|---|
| Cloudflare | Hosting, CDN, DNS, edge compute, bot protection (Turnstile), and the D1 database holding enquiries | Global edge; primary D1 region set to EU where the client requires it | SCCs + UK Addendum |
| GitHub | Source code repositories and deployment pipelines. Contains no client personal data by policy | United States | SCCs + UK Addendum |
Communication
| Provider | Purpose | Data location | Transfer basis |
|---|---|---|---|
| Resend | Transactional email — enquiry receipts, project notifications, password and access mails | United States | SCCs + UK Addendum |
| Kit | Newsletter and marketing email. Holds the email address and tags of anyone who opted in | United States | SCCs + UK Addendum |
| Cal.com | Booking of intro and project calls. Holds name, email, and the time you chose | EU / United States | SCCs + UK Addendum |
Business operations
| Provider | Purpose | Data location | Transfer basis |
|---|---|---|---|
| [Payment provider] | Invoicing and payment. Card details go to the provider, never to us | [to confirm] | SCCs + UK Addendum |
| [Accounting tool] | Bookkeeping and statutory records. Holds billing contact details | [to confirm] | SCCs + UK Addendum |
Client project vendors
When we build for you, your project may rely on services you contract directly. We configure them; the agreement is between you and them. The ones we most often recommend:
- Hosting and edge — Cloudflare, Vercel, or the client's existing provider.
- Payments — Stripe, or a local processor where the market requires one.
- Authentication — Clerk, Auth0, or a self-hosted option where data residency matters.
- Analytics — a privacy-first, cookieless provider by default; a heavier stack only if you ask for it.
- Media and storage — Cloudflare R2 or the object storage attached to your chosen platform.
Notice of changes
We publish a new subprocessor here at least 30 days before it starts processing anything. Clients on an active agreement can subscribe to change notifications by emailing legal@webtechnosys.dev with the subject "subprocessor notice".
Objecting
If you object to a new subprocessor on reasonable data protection grounds, tell us within those 30 days. We will look for a workable alternative. If none exists, you may terminate the affected part of the service without penalty and we will refund anything prepaid for work not delivered.
Contact
legal@webtechnosys.dev — the Data Processing Agreement page sets out the contractual side of all this.
Need this in your vendor form?
We can complete a security or vendor questionnaire, usually within five working days.