Legal
Sub-processors
The third parties that process data on our behalf, what each one is for, and how you are notified before the list changes.
- Effective
- Last updated
- Entity
- Shortspan Technologies
01Current sub-processors
Each sub-processor below is engaged under a written contract that limits it to our documented instructions and imposes data protection obligations no less protective than those in our Data Processing Addendum.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| DigitalOcean, LLC | Primary application hosting, managed database, object storage | All customer data at rest (encrypted), account metadata, audit logs | United Kingdom (London, LON1) |
| Paddle.com Market Ltd. | Merchant of record - subscription billing, tax, invoicing | Billing contact name, email, country, payment instrument (held by Paddle) | United Kingdom, European Union |
| Cloudflare, Inc. | DNS, TLS termination, CDN, DDoS and bot mitigation | IP address, request metadata, TLS handshake data | Global edge network |
| Resend (Plus Five Five, Inc.) | Transactional email - verification, access approvals, alerts | Recipient name, email address, message content | United States |
Secret material never reaches any sub-processor. It is encrypted within our own infrastructure and is excluded from payment, email, analytics, and error-monitoring flows by design.
02Affiliates
Shortspan Technologies may use its own group companies to provide support, engineering, and administration. Any such affiliate is bound by the same obligations as an external sub-processor, and we remain fully responsible for its performance.
03Notice of changes
- 01We publish an update to this page before a new sub-processor begins processing personal data.
- 02Customers on paid plans receive at least thirty (30) days’ notice by email to the Workspace owner.
- 03You may object on reasonable data protection grounds within that period by writing to our privacy contact.
- 04If we cannot resolve the objection, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid, unused fees.
To subscribe to sub-processor change notices without waiting for the email, write to privacy@shortspan.dev and we will add your address to the notification list.
04How we choose them
- We prefer the smallest possible number of sub-processors, and we review the list whenever a dependency is added.
- Each provider is assessed for its security posture, its published compliance attestations, its breach history, and its transfer mechanism.
- We require a data processing agreement and, where personal data leaves the EEA or the UK, the Standard Contractual Clauses or an equivalent safeguard.
- We re-assess each provider at least annually and after any publicly reported incident affecting it.
05Questions
Vendor questionnaires and security reviews: security@shortspan.dev. Data protection questions about this list: privacy@shortspan.dev.