Subprocessors

Version: 1.0Effective Date: 2026-05-11
Ver en Español
Table of Contents

1. Overview

Clodei processes personal data on behalf of its customers as a processor under GDPR Art. 28. To deliver the platform we rely on a small set of subprocessors for infrastructure, payments, email delivery, networking, and inference. This page lists every subprocessor we engage today, what each one processes, where they operate, and the legal mechanism we rely on for the relationship.

Review cadence is trimestral. The list is maintained in sync with docs/compliance/subprocessors.yaml and audited per release via the CI parity test.

2. Active subprocessors

ProviderRoleData categoriesPrimary locationLegal mechanismProvider DPA
Supabase Inc.
active
Auth + Postgres + Storage
  • identity
  • billing
  • consents
  • app_metadata
EU — Paris (eu-west-3)DPF + SCCsView DPA →
Stripe Payments Europe Ltd.
active
Pagos y facturación
  • identity
  • billing
  • payment_method_metadata
IrelandDPF + SCCsView DPA →
Resend Inc.
active
Email transaccional
  • identity
  • transactional_email_content
EU — Ireland (eu-west-1)DPF + SCCsView DPA →
Cloudflare Inc.
active
R2 storage + Tunnels + Edge CDN
  • invoice_pdfs
  • traffic_metadata
  • ip_address
Global edge + Ireland HQDPF + SCCsView DPA →
Vercel Inc.
active
Hosting frontend (SSR + Edge)
  • ip_address
  • cookies
  • telemetry
Global edgeDPF + SCCsView DPA →
Railway Corp.
active
Hosting backend (FastAPI)
  • application_state
EU region (eu-west-1)DPF + SCCsView DPA →
NetBird GmbH
active
VPN mesh overlay (provider node ↔ control plane)
  • ip_address
  • network_metadata
EU — GermanyEU directo (no transferencia internacional)View DPA →
Google Cloud (Google Ireland Ltd.)
active
GKE para inferencia GPU (MVP) + Cloud Billing API (landing)
  • inference_prompts_responses
EU — europe-west4 (Países Bajos)DPF + SCCsView DPA →
KUMO Networks
planned
Datacenter Tier IV (producción futura)
  • hosting_físico
SpainEU directopending signature

Removed subprocessors

ProviderRoleRemoved onReplaced by
Postmark (ActiveCampaign)
Email transaccional (Sprints 1–4)2026-04-22resend

3. Notification of changes

Clodei notifies B2B customers of material changes to this list — new subprocessor categories, changes affecting the scope or location of personal data — at least 14 calendar days in advance via the customer dashboard and via email to the primary billing contact, per the DPA Art. 28(2)/(4) clause and Art. 13 / Art. 14 GDPR transparency obligations.

4. Contact

Questions about this list, our DPA, or international transfer mechanisms: legal@clodei.com.