Subprocessors
On this page
1. Overview
Clodei processes personal data on behalf of its customers as a processor under GDPR Art. 28. To deliver the platform we rely on a small set of subprocessors for infrastructure, payments, email delivery, networking, and inference. This page lists every subprocessor we engage today, what each one processes, where they operate, and the legal mechanism we rely on for the relationship.
Review cadence is trimestral. The list is maintained in sync with docs/compliance/subprocessors.yaml and audited per release via the CI parity test.
2. Active subprocessors
| Provider | Role | Data categories | Primary location | Legal mechanism | Provider DPA |
|---|---|---|---|---|---|
Supabase Inc. active | Auth + Postgres + Storage |
| EU — Paris (eu-west-3) | DPF + SCCs | View DPA → |
Stripe Payments Europe Ltd. active | Pagos y facturación |
| Ireland | DPF + SCCs | View DPA → |
Resend Inc. active | Email transaccional |
| EU — Ireland (eu-west-1) | DPF + SCCs | View DPA → |
Cloudflare Inc. active | R2 storage (invoices + user data volumes, EU jurisdiction) + Tunnels + Edge CDN |
| Global edge + Ireland HQ | DPF + SCCs | View DPA → |
Vercel Inc. active | Hosting frontend (SSR + Edge) |
| Global edge | DPF + SCCs | View DPA → |
Railway Corp. active | Hosting backend (FastAPI) |
| EU region (eu-west-1) | DPF + SCCs | View DPA → |
NetBird GmbH active | VPN mesh overlay (provider node ↔ control plane) |
| EU — Germany | EU directo (no transferencia internacional) | View DPA → |
Google Cloud (Google Ireland Ltd.) active | GKE para inferencia GPU (MVP) + Cloud Billing API (landing) |
| EU — europe-west4 (Países Bajos) | DPF + SCCs | View DPA → |
KUMO Networks planned | Datacenter Tier IV (producción futura) |
| Spain | EU directo | pending signature |
Removed subprocessors
| Provider | Role | Removed on | Replaced by |
|---|---|---|---|
Postmark (ActiveCampaign) | Email transaccional (Sprints 1–4) | 2026-04-22 | resend |
3. Notification of changes
Clodei notifies B2B customers of material changes to this list — new subprocessor categories, changes affecting the scope or location of personal data — at least 14 calendar days in advance via the customer dashboard and via email to the primary billing contact, per the DPA Art. 28(2)/(4) clause and Art. 13 / Art. 14 GDPR transparency obligations.
4. Contact
Questions about this list, our DPA, or international transfer mechanisms: legal@clodei.com.