Sub-processor List

Dynalope SA uses the following sub-processors to deliver the Dynalope platform. Any change to this list is communicated to B2B customers at least 30 days before it takes effect, in accordance with GDPR Article 28 and our Data Processing Agreement.

Name Role Data types processed Region Status
Vercel Inc. Application hosting (Next.js apps + Astro marketing site) Account metadata; Request logs US (Frankfurt edge) — status: Active
Supabase, Inc. Postgres database, auth, storage, edge runtime All user content; Auth metadata EU (self-hosted on Hisland VPS at MVP; Supabase Cloud EU planned post-pilot) — status: Active
Resend Transactional email delivery Recipient address; Message content for magic link, password reset, export download, deletion confirmation, DPA notice EU (Ireland) — status: Active
Paddle.com Market Limited Subscription billing (merchant of record) Email; Billing address; Payment method (handled by Paddle directly; never reaches Dynalope) UK + US (Paddle is the merchant of record) — status: Active
OpenAI, L.L.C. Embeddings generation (text-embedding-3-small) and inline AI triage (Phase 2) Individual item titles and descriptions (no bulk, no health data, no other-user content per ADR-024) US (via Vercel AI Gateway; zero retention DPA per NFR24) — status: Active
Anthropic, PBC Adaptive evening prompts + AI summarisation (Phase 2) Per-user reflections, scoped to the active user only US (via Vercel AI Gateway; zero retention DPA per NFR24) — status: Active
Sentry (Functional Software, Inc.) Error monitoring with allowlisted field-stripping Stack traces; Request URL; User ID (no body content, no health data) US (project configured for EU-region storage where available) — status: Active
PostHog Product analytics + RUM (self-hosted on Hetzner Cloud EU) Page paths; Feature usage events; RUM metrics (no body content, no health data) EU (Hetzner Falkenstein) — status: Active
Cloudflare, Inc. DNS + WAF in front of dynalope.com / db.dynalope.com DNS query metadata; Request IPs (for WAF rules) Global (DNS-only; no proxying of authenticated app traffic) — status: Active
Hetzner Online GmbH Bare-metal hosting for the Hisland VPS (Supabase stack + PostHog) Postgres + Storage payload (all data, encrypted at rest by Supabase) EU (Falkenstein) — status: Active
Vercel Inc.
Role: Application hosting (Next.js apps + Astro marketing site)
Data: Account metadata; Request logs
Region: US (Frankfurt edge)
Status: Active
Supabase, Inc.
Role: Postgres database, auth, storage, edge runtime
Data: All user content; Auth metadata
Region: EU (self-hosted on Hisland VPS at MVP; Supabase Cloud EU planned post-pilot)
Status: Active
Resend
Role: Transactional email delivery
Data: Recipient address; Message content for magic link, password reset, export download, deletion confirmation, DPA notice
Region: EU (Ireland)
Status: Active
Paddle.com Market Limited
Role: Subscription billing (merchant of record)
Data: Email; Billing address; Payment method (handled by Paddle directly; never reaches Dynalope)
Region: UK + US (Paddle is the merchant of record)
Status: Active
OpenAI, L.L.C.
Role: Embeddings generation (text-embedding-3-small) and inline AI triage (Phase 2)
Data: Individual item titles and descriptions (no bulk, no health data, no other-user content per ADR-024)
Region: US (via Vercel AI Gateway; zero retention DPA per NFR24)
Status: Active
Anthropic, PBC
Role: Adaptive evening prompts + AI summarisation (Phase 2)
Data: Per-user reflections, scoped to the active user only
Region: US (via Vercel AI Gateway; zero retention DPA per NFR24)
Status: Active
Sentry (Functional Software, Inc.)
Role: Error monitoring with allowlisted field-stripping
Data: Stack traces; Request URL; User ID (no body content, no health data)
Region: US (project configured for EU-region storage where available)
Status: Active
PostHog
Role: Product analytics + RUM (self-hosted on Hetzner Cloud EU)
Data: Page paths; Feature usage events; RUM metrics (no body content, no health data)
Region: EU (Hetzner Falkenstein)
Status: Active
Cloudflare, Inc.
Role: DNS + WAF in front of dynalope.com / db.dynalope.com
Data: DNS query metadata; Request IPs (for WAF rules)
Region: Global (DNS-only; no proxying of authenticated app traffic)
Status: Active
Hetzner Online GmbH
Role: Bare-metal hosting for the Hisland VPS (Supabase stack + PostHog)
Data: Postgres + Storage payload (all data, encrypted at rest by Supabase)
Region: EU (Falkenstein)
Status: Active

This list reflects all sub-processors as of 11 May 2026. Subscribe to receive 30-day pre-notification of changes (via our B2B contract — not a self-serve mailing list at MVP).

Svenska