Sub-processors
Last updated: 2026-04-30
The following sub-processors are engaged by ObligoBoard to process personal data on behalf of its customers, in accordance with Article 28(2) GDPR and Section 6.4 of the DPA.
Material updates to this list are notified to customers with a signed DPA at least 30 days in advance, as provided in Section 6.4(b) of the DPA.
| Sub-processor | Service | Region (data location) | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN, edge runtime, blob storage | EU (Frankfurt) primary; global edge | EU SCCs (Module 3) for any US fallback; Vercel DPA in place |
| Neon Inc. | Managed PostgreSQL database hosting | EU (Frankfurt) | EU SCCs (Module 3); Neon DPA in place |
| Stripe Payments Europe Ltd. | Payment processing, subscription billing | EU (Ireland) primary; some routing to US via Stripe global infrastructure | Stripe DPA + EU SCCs (Module 3); Stripe is also an independent Controller for fraud-prevention purposes |
| Resend Inc. | Transactional email delivery | EU (Frankfurt) and US | EU SCCs (Module 3) for US-region processing; Resend DPA in place |
| Font Awesome (Fonticons, Inc.) | Icon CDN serving | Global edge (US-headquartered) | EU SCCs (Module 3); Font Awesome DPA available; minimal Personal Data — IP address and User-Agent only via CDN logs |