Sub-processors
Last updated 31 August 2026. Effective from 31 August 2026.
Every third party that processes personal data on our instructions. We give notice before adding a new one.
Current list
| Processor | What they do | Where | Transfer mechanism |
|---|---|---|---|
| Neon (Postgres hosting) | Primary database — accounts, automations, contacts, send history | United States (us-east-1) | EU Standard Contractual Clauses / UK IDTA |
| Railway | Always-on webhook receiver and message worker | United States (US-East) | EU Standard Contractual Clauses / UK IDTA |
| Upstash / Railway Redis | Job queue, rate-limit counters, de-duplication keys | United States (US-East) | EU Standard Contractual Clauses / UK IDTA |
| Vercel | Dashboard hosting and edge delivery | United States (iad1) | EU Standard Contractual Clauses / UK IDTA |
| Resend | Transactional email (account notices, withdrawal acknowledgements) | United States | EU Standard Contractual Clauses |
| Sentry | Error monitoring. Configured to scrub tokens and message bodies. | United States / European Union | EU Standard Contractual Clauses |
| Dodo Payments | Merchant of record. Independently controls payment and tax data; we never see full card details. | United States / European Union | Independent controller |
| Meta Platforms, Inc. | Source of Instagram comment and messaging data, and the destination for messages you send. | Global | Meta Platform Terms |
What is deliberately absent
No advertising networks. No analytics vendors. No data brokers. No model training providers. Nobody receives your data who is not in the table above.
Notice of changes
We email account holders at least 14 days before a new sub-processor starts processing, so that customers with a data processing agreement have time to object.
To be notified, email privacy@inyourdm.com with the subject “sub-processor notifications”.