This list identifies third parties expected to process Customer Personal Data for OnStat as a processor. The list is intentionally limited to providers that receive Customer Personal Data to operate the Service on OnStat's behalf.
| Provider | Service and Customer Personal Data | Processing location | Used when | Listed from |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS) | Compute, PostgreSQL/RDS, Redis/ElastiCache, S3, load balancing, backups, and Amazon SES email delivery; Service data required by each enabled feature and email/delivery metadata | Primary Service region eu-central-1 (Germany); support and AWS-subprocessor locations under the AWS DPA | Core Service | 20 February 2026 |
| Cloudflare, Inc. | DNS, CDN, edge TLS, WAF, and DDoS protection; IP address, request URL and headers, network metadata, and content transiting the edge | Cloudflare's global edge network, subject to the Cloudflare DPA | Core public domains | 20 February 2026 |
| Functional Software, Inc. d/b/a Sentry | Error and performance monitoring; sanitized error events, stack traces, request/device metadata, and pseudonymous technical identifiers | EU/Germany project ingest; support and subprocessor access under Sentry's contractual terms | Production monitoring | 20 February 2026 |
| Anthropic, PBC | AI prompts and questions, schema/context, selected aggregate or result samples, and limited private-dialog excerpts | United States storage and multi-region processing unless account-specific terms provide otherwise | Relevant AI features | 20 February 2026 |
| OpenAI Ireland Ltd. | AI model inference, embeddings, and classification; prompts and questions, schema/context, selected results, and limited private-dialog excerpts | Locations identified in OpenAI's DPA and current subprocessor list | When a configured AI feature invokes OpenAI | 20 February 2026 |
Amazon SES is part of the AWS service and is therefore not listed as a separate email provider.
Other providers and Customer-selected recipients
The following services are not subprocessors for Customer Personal Data under the DPA:
- IOOI Sp. z o.o. (Inqud) operates hosted payment services and acts as an independent controller or recipient for its own payment, fraud-prevention, AML/KYC, accounting, and legal obligations. Its handling is governed by the Inqud Privacy Notice.
- Google Analytics is currently disabled pending consent-management controls. If later enabled, it processes marketing-site visitor data for OnStat's own controller purposes and is disclosed in the Privacy Notice, not in this Customer Data subprocessor list.
- GIPHY, Inc. receives viewer IP address, device/request metadata, and the requested GIF identifier when the application delivers a GIF directly from GIPHY. This third-party delivery is disclosed in the Privacy Notice.
- DB-IP Lite is a locally downloaded IP-geolocation database. OnStat does not make a live personal-data lookup to DB-IP; the applicable license attribution is displayed in the product.
- OnlyFans, Telegram, Meta, customer-configured postback destinations, and Customer-selected ChatGPT, Claude, API, OAuth, or MCP clients are independent platforms or Customer-selected recipients for the relevant delivery. They are not appointed by OnStat as subprocessors for that delivery unless a separate written arrangement expressly provides otherwise.
Revoking an OnStat connection stops future authorized access through that connection but does not itself delete copies already retained by a Customer-selected recipient.
Partners, chatters, contractors, and other people who receive a Customer-created Shared Portal link are also Customer-selected recipients or Customer personnel, not OnStat Subprocessors merely because OnStat provides the portal.
Change notices
Customers may subscribe to Subprocessor change notices by emailing [email protected]. OnStat will provide at least 30 days’ prior notice before a new Subprocessor begins processing Customer Personal Data, except for an urgent legal or security need. Objections follow Section 6 of the DPA.
Contact
Questions or objections: [email protected]