PaysumSubprocessors
Effective November 3, 2026
1. Current subprocessors
These companies process personal data on our behalf to run the Service. Each is bound by a written agreement that requires at least the protection our Data Processing Agreement gives.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, file storage | All platform data | EU (Ireland) |
| Vercel | Application hosting, CDN | All data in transit, request logs | EU (Ireland); global edge network |
| Cloudflare | Bot protection, images | IP address, browser data | Global; US company |
| Upstash | Rate limiting | IP address, account ID | United States |
| Resend | Transactional and inbound email | Email address, email content | EU (Ireland); US company |
| Amazon Web Services | Backup transactional email (Amazon SES) | Email address, email content | EU (Stockholm) |
| Sentry | Error monitoring | Technical data, account ID | United States |
| Stripe | Plan billing | Seller billing and payment data | United States; EU |
| proxycheck.io | VPN and proxy detection at checkout | Buyer IP address | United Kingdom |
| Discord | Sign-in, role delivery, bot notifications | Discord ID, username, order notices | United States |
Transfers outside the European Economic Area are covered by an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or by the Standard Contractual Clauses.
2. Services sellers choose
Payment providers (such as Stripe, PayPal and crypto payment services), license systems, domain registrars and storefront tools that a seller connects to their store are not our subprocessors. The seller chooses them and contracts with them directly, and they process data under their own terms.
3. Changes
We update this page before a new subprocessor starts processing personal data and notify sellers at least 14 days in advance by email or in the dashboard. Sellers can object as set out in the DPA. Questions: [email protected].