In short
- A sub-processor is a company that processes personal data on our behalf so that we can provide the service.
- Customer data is processed only by the providers in the first table, and stored in the European Union.
- Website measurement providers process visitors’ data only after they allow it, never customer data.
- We announce a new sub-processor 30 days before it starts.
How we choose them
Before a provider handles personal data for us, we review its security and data protection, and sign a contract that binds it to our instructions and to obligations no less protective than our data processing addendum. We remain responsible for what it does.
The service
These providers process Customer Personal Data and account data to run Continuumship:
| Provider | What for | Where |
|---|---|---|
| Google Cloud | The application servers and the PostgreSQL database, on a private network; the database has no public address | Frankfurt, Germany |
| Cloudflare | DNS, and private object storage for files, reached only through signed links | Files in the EU jurisdiction; DNS at the edge |
| Stripe | Subscriptions, invoices and payments | Under Stripe's own data processing terms |
The website
These providers measure how our website is used. They load only after a visitor allows their category in the cookie banner, and never receive customer data. The cookie notice lists the cookies they set.
| Provider | What for | Where |
|---|---|---|
| Microsoft Corporation (Clarity) | Heatmaps and session recordings of how website pages are scrolled and clicked; only after you allow Analytics | United States and other countries where Microsoft operates, under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
Changes
We tell the owners of paid workspaces at least 30 days before a new sub-processor starts processing Customer Personal Data, and update this page. To be told as well, write to hello@continuumship.com. How to object is described in the data processing addendum.