Subprocessors
The third parties we rely on to operate AppThrive — hosting, database, error tracking, email — with what each one processes and where. Per our Data Processing Addendum, we announce changes to this list at least 30 days before any new subprocessor is engaged.
Last updated: April 21, 2026
| Subprocessor | Purpose | Data accessed | Location | Safeguards |
|---|---|---|---|---|
| Vercel, Inc. | Application hosting | All service data (transient) | USA (EU available on Enterprise) | DPA, SCCs |
| Neon, Inc. | Database hosting | All persistent data | USA (EU available on Enterprise) | DPA, SCCs |
| Upstash, Inc. | Cache / rate limiting | Non-PII cache keys | USA | DPA, SCCs |
| Clerk, Inc. | Authentication | User account data, sessions | USA | DPA, SCCs, SOC 2 |
| Inngest, Inc. | Background job processing | Event payloads (transient) | USA | DPA, SCCs |
| Stripe, Inc. | Payment processing | Billing info, tax ID | USA / EU | DPA, SCCs, PCI-DSS |
| Sentry (Functional Software, Inc.) | Error tracking | Error logs, stack traces (PII scrubbed) | USA | DPA, SCCs |
| Axiom, Inc. | Log aggregation | Application logs | USA / EU | DPA |
| Resend, Inc. | Internal transactional email (not BYO path) | Platform email addresses | USA | DPA |
| PostHog, Inc. | Product analytics | Usage events (pseudonymized) | USA / EU | DPA, SCCs |
| Cloudflare, Inc. | DNS, DDoS protection | HTTP request metadata | Global | DPA |
What's not on this list
ESPs, AI providers, and other third-party services you connect to AppThrive — Resend and SendGrid on the BYO-sender path, OpenAI, Anthropic, and any other tools you bring — are not subprocessors of AppThrive. They're separate processors you engage directly, under your own contract with them. AppThrive orchestrates; you own the relationship.
Questions or concerns?
If you have a compliance or procurement question about any of these subprocessors — their DPAs, SOC 2 status, data residency options, or transfer mechanisms — email jahangir@efoli.com and we'll get you what you need.