Subprocessors
The third-party services we use to deliver ConneqtOS. Bound by DPAs; updated with 14-day notice.
Last updated:
ConneqtOS engages the subprocessors listed below to help deliver the Service. Each is bound by a Data Processing Agreement appropriate to their role. We give at least 14 days' notice before adding or changing subprocessors (email to account owners + update on this page).
Current subprocessors
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Railway railway.com | Application hosting + PostgreSQL database | All customer data (encrypted at rest, isolated per-organization) | US-East (primary), backups replicated |
| Stripe stripe.com | Payment processing (PCI DSS Level 1) | Billing details: customer ID, subscription info, card last-4 (full card never stored by us) | US + EU |
| Resend resend.com | Transactional email delivery | Recipient emails, subject + body of transactional emails | US + EU |
| Google google.com | OAuth sign-in (optional) | Email + name only (when users choose Google sign-in) | Global |
| Cloudflare cloudflare.com | DDoS protection, TLS termination, DNS | IP addresses, request metadata (no content) | Global edge network |
International transfers
Some subprocessors process data outside the EEA/UK. We rely on the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum for all such transfers. Copies available on request from dpo@leadconneqt.com.
Notifications
Subscribe to subprocessor change notifications by emailingdpo@leadconneqt.comwith the subject "Subprocessor Notifications", we'll keep you on the list.
Objecting to a new subprocessor
If you have a reasonable objection to a new subprocessor, email us within the 14-day notice window. If we can't resolve your objection, you may terminate the affected service with a pro-rata refund for unused prepaid periods.