Skip to main content

Sub-processors

Third parties that may process customer data when you use ReguNav. Customers will be notified at least 30 days before any new sub-processor is added. Single source of truth lives at packages/seed-data/src/sub-processors.ts (Constitution Amendment 5).

Sub-processorPurposeRegionSafeguards
Cloudflare, Inc.Edge compute (Workers), CDN, DNS, DDoS protection, WAF, R2 object storage, D1 SQL, Queues, KV, LogpushGlobal (customer-region selectable; EU-only on request)EU SCCs Module 2 + UK IDTA + Swiss FDPIC supplement; DPF-certified
Stripe, Inc.Billing, subscription management, tax calculationUnited States (Stripe is the PCI-DSS Level 1 processor)EU SCCs Module 2/3 + UK IDTA; DPF-certified
Clerk, Inc.Authentication, SSO, SAML 2.0, OIDC, SCIM provisioningUnited StatesEU SCCs Module 2 + UK IDTA; SOC 2 Type II
Cerbos Inc.Authorization policy decision point (PDP)US / EU (bundle ships to our edge; PDP runs in-tenant)EU SCCs Module 2 (data limited to identifiers)
Postmark (ActiveCampaign LLC)Transactional email delivery via the single outbound rail (Constitution Amendment 4)United StatesEU SCCs Module 2 + UK IDTA; DPF-certified
GitHub, Inc. (Microsoft)Source-code hosting + GitHub App integration surface (Code Constitution)United StatesEU SCCs Module 2 (Microsoft Online Services DPA); DPF-certified
Linear, Inc.Issue tracking, engineering workflowUnited StatesEU SCCs Module 2 + UK IDTA
MeilisearchFull-text search indexEU (Frankfurt)EU-resident processor; no transfer required
Customer-elected BYOC vault provider (AWS / Azure / GCP / Cloudflare)Holds Customer signing keys + audit-trail copy in Customer's own accountCustomer-controlledCustomer-controlled; Regunav holds zero credentials
Hugging Face, Inc.Optional model hosting for customers using HF-hosted inferenceUnited States / France (customer choice)EU SCCs Module 2 + DPA

Subscribe to sub-processor change notifications: trust@regunav.com