Subprocessors
Last updated 11 September 2026.
These are the companies that can hold or handle data on our behalf. If a service is not on this list, it does not receive your data — and if we add one, you hear about it before it starts.
In use today
| Company | What it does for us | What it can hold | Where |
|---|---|---|---|
| DigitalOcean | Application hosting, managed PostgreSQL, and Spaces object storage — the product itself. | Everything the product stores: accounts, workspaces, reports and their free text, captured context, files reporters attach, and security logs. | United States (San Francisco) |
| Cloudflare | DNS, TLS and CDN for our domains; hosting for this marketing site; the key-value store behind the early-access form. | Early-access email addresses and the optional website field; request metadata including IP addresses, in its own logs, for routing and abuse prevention. | Global edge network |
| Google Forms and Sheets, which receive a copy of each early-access signup so it lands somewhere a human reads. | Early-access email addresses and the optional website field. Nothing from the product, and no visitor data. | United States | |
| The email relay | Delivers account email: verification links, password resets, teammate invitations, and notifications about new reports. | Recipient addresses and the contents of those messages, which can include a report title and the name of the project it belongs to. | Depends on the relay — see the note below |
About the relay. The product speaks plain SMTP rather than a vendor's SDK, so the relay is a deployment choice and not baked into the code. We have not finished selecting the provider for the production deployment. We will name it in this table before the first customer account sends its first email, and we will not send your account mail through a relay that is not named here.
Ready, but not yet receiving anything
| Company | What it would do | What it would hold | Status |
|---|---|---|---|
| Paddle | Merchant of record for subscriptions: checkout, payment processing, tax, and invoices. | Your billing contact details and payment method, which Paddle holds — we never see or store a card number. | Integrated in code, no live account, nothing charged. Becomes active the first day anything is for sale. |
Things you can switch on yourself
AI assistance is off by default and stays off until a workspace admin enables it, names the model endpoint, and acknowledges what will be sent. If you point it at a hosted model provider, that provider becomes your subprocessor by your own choice — it is not on our list because we do not pick it and, for workspaces that leave AI off, it never sees anything. What may be sent is controlled per workspace, one switch per category (metadata, reporter text, and so on).
Changes
Before we add a subprocessor that will handle customer or visitor data, we will update this page and email the admin of every workspace with an account. You can object. If we cannot resolve the objection, you can end your subscription and take your data with you — the terms of that are in the data processing agreement.
To be told about changes without checking, write to privacy@commentunderscore.com and ask to be on the notification list.