Subprocessors

What it does

Runs the service: Workers (API, edge, builder, site), R2 (published component bundles), KV (site manifests), Queues, Analytics Engine, Workers Logs, Turnstile and the CDN that delivers the loader and components.

Data it handles

• Every request to Taggor and to the loader, including what a visitor submits through a component on its way to storage (the visitor IP is not stored by Taggor)
• Published component bundles and site manifests (customer code and settings)
• Application logs and load-point metrics without e-mail, full IP or submission content

Where

Global network: a request is processed in the Cloudflare data center that serves it, which can be outside Brazil, the EEA and the UK (DPA clause 6.1). Taggor's R2 buckets use the location hint enam, which Cloudflare documents as best effort and not a guarantee. [NOT CONFIRMED: the processing and storage location of Workers Logs, KV, Queues and Analytics Engine; no official page naming it was found on 2026-11-10]

Certifications and frameworks

• Global CBPR and Global PRP certification (DPA clause 3.2)
• Data Privacy Framework (DPA clause 6.4: Cloudflare states that it complies)
• [NOT CONFIRMED: ISO 27001, SOC 2 or PCI DSS; the compliance pages opened on 2026-11-10 named no certification in the text read]

International transfer

DPA version 6.4 (effective 2026-04-03): it applies from the DPA effective date, when the customer signs or agrees to it (it is not automatic). It includes the UK Addendum (version B1.0). The EU Standard Contractual Clauses (Decision 2021/914) apply only to restricted transfers that the Data Privacy Framework does not cover; Cloudflare states that it complies with the Data Privacy Framework.

Notice of changes by the vendor

The DPA (clause 4.4) commits to list new subprocessors at least 30 days before they start, with 10 days to object. The list page offers an RSS feed.

Official pages opened on

2026-11-10

• Data processing agreement
• Security
• The vendor's subprocessors

What it does

Managed PostgreSQL database: accounts, workspaces, sites, component versions, collected data (form submissions) and audit records.

Data it handles

• Account data (e-mail, name), workspace data, API key hashes, audit records
• What visitors submit through the customer's components (the customer is the controller)

Where

AWS US East (N. Virginia), aws-us-east-1. The region of a Neon project cannot be changed after creation (Neon regions page, last updated 2026-10-14). Neon's own subprocessors include AWS, Google, Microsoft and Oracle with processing location 'Customer Selected' (Databricks list, updated 2026-06-09).

Certifications and frameworks

• SOC 2 Type 1 and Type 2, ISO 27001 and ISO 27701 (Neon compliance page, last updated 2026-10-30; no audit dates given there)
• Neon states that it is not PCI DSS compliant (Taggor does not store card data: payments go to Stripe)

International transfer

A DPA is built into Neon's terms for every customer (Neon's GDPR blog post, read on 2026-11-12). Neon states there that it relies on the Data Privacy Framework. [NOT CONFIRMED: Standard Contractual Clauses or the UK Addendum in that DPA; the DPA PDF could not be read] [NOT CONFIRMED: whether the contracting entity is Neon, LLC or Databricks, Inc.] [TO CONFIRM: which DPA the owner signs or accepts]

Notice of changes by the vendor

[NOT CONFIRMED: a notice period; the Databricks subprocessor page only offers a subscription to be told of new subprocessors]

Official pages opened on

2026-11-10

• Data processing agreement
• Security
• The vendor's subprocessors

What it does

Sign-in and identity of the people who use Taggor (AuthKit).

Data it handles

• E-mail, name and sign-in data of the account holder

Where

United States, for EEA, Swiss and UK data: the DPA (Exhibit B) names the United States as where transferred data is stored or accessed. [NOT CONFIRMED: where the AuthKit data is located in general] The security page makes no data residency statement.

Certifications and frameworks

• SOC 2 Type 2 certified; GDPR and CCPA compliant (as the security page prints them). ISO 27001 is not mentioned there.

International transfer

DPA (last updated 2023-06-27): EU Standard Contractual Clauses, modules two and three (Exhibit C), and the UK Addendum (version B1.0). The Data Privacy Framework is not mentioned in the DPA.

Notice of changes by the vendor

The DPA (section 3(d)) gives notice by updating its subprocessor page and 14 calendar days to object. [NOT CONFIRMED: the list itself; workos.com/legal/subprocessors redirects to the WorkOS trust center and its content could not be read on 2026-11-10]

Official pages opened on

2026-11-10

• Data processing agreement
• Security
• The vendor's subprocessors

What it does

Sends e-mail: invitations, submission notices to recipients the customer names, retention notices, usage alerts and subprocessor change notices.

Data it handles

• Recipient address, subject and body of each message (a submission notice can carry what a visitor submitted)

Where

United States: 'Stored data is held in the United States' (security page); the primary processing is in the United States (DPA section 6.1). The region chosen for a sending domain controls where mail is sent from, not where it is stored.

Certifications and frameworks

• SOC 2 Type II (Resend states it is compliant); GDPR (Resend states it complies with all articles). Resend states that it holds no ISO 27001 certificate.

International transfer

DPA (last updated 2025-12-31): EU Standard Contractual Clauses (section 6.2), UK SCCs (6.4), Swiss modifications (6.5) and the EU-U.S. Data Privacy Framework with the UK Extension (11.1).

Notice of changes by the vendor

The DPA (section 4.2) commits to written notice at least 14 days ahead, with that window to object (4.3 and 4.4). Resend's own list has 22 subprocessors, all listed in the USA (updated 2026-11-05).

Official pages opened on

2026-11-10

• Data processing agreement
• Security
• The vendor's subprocessors

Not in use yet

What it does

Payments and subscription billing. For Taggor's own subscription payments Stripe acts as a controller (an independent provider); it is NOT a subprocessor of what visitors submit through customers' components. Not in use yet: it is built in Stripe's test mode and nothing is charged until the owner switches it on (decision 67).

Data it handles

• Payer identity, billing and tax data, and card data, which Stripe collects itself and Taggor never stores

Where

United States: the version of the DPA opened (Brazil, in Portuguese) says users transfer personal data to Stripe, LLC in the United States (section 6.1). [NOT CONFIRMED: the version of the DPA the owner's account will sign, and the countries of Stripe's own subprocessors; the Brazil list read on 2026-11-10 shows 'last updated 2023-07-21' and 20 entries in the USA, UK, Ireland, Spain, Colombia, Malaysia, the Philippines, Canada and Australia]

Certifications and frameworks

• PCI DSS Level 1 service provider; SOC 1 and SOC 2 Type II reports yearly, on request; a public SOC 3 report (Stripe security page)
• EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework; CBPR and PRP certifications (Stripe security page)

International transfer

DPA (last updated 2026-09-28): EU Standard Contractual Clauses (modules one, two and three), UK Addendum and the Data Privacy Framework. Stripe acts as processor for the processing it does on the user's behalf and as controller for its own purposes (fraud prevention, legal duties, improving its products).

Notice of changes by the vendor

The DPA (section 3.2(a)) commits to e-mail notice 30 days ahead only to users who subscribed to the list updates in their Stripe dashboard, with 30 days to object.

Official pages opened on

2026-11-10

• Data processing agreement
• Security
• The vendor's subprocessors

Subscribe to get an e-mail when this list changes. You get one e-mail to confirm the address, and notices only after you confirm. Every notice has a link to cancel.