Sub-processors
Last updated: 2026-07-28
The following sub-processors are engaged by ObligoBoard to process personal data on behalf of its customers, in accordance with Article 28(2) GDPR and Section 6.4 of the DPA.
Material updates to this list are notified to customers with a signed DPA at least 30 days in advance, as provided in Section 6.4(b) of the DPA.
| Sub-processor | Service | Region (data location) | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN, edge runtime, blob storage | EU (Frankfurt) primary; global edge | EU SCCs (Module 3) for any US fallback; Vercel DPA in place |
| Neon Inc. | Managed PostgreSQL database hosting | EU (Frankfurt) | EU SCCs (Module 3); Neon DPA in place |
| Stripe Payments Europe Ltd. | Payment processing, subscription billing | EU (Ireland) primary; some routing to US via Stripe global infrastructure | Stripe DPA + EU SCCs (Module 3); Stripe is also an independent Controller for fraud-prevention purposes |
| Resend Inc. | Transactional email delivery | EU (Frankfurt) and US | EU SCCs (Module 3) for US-region processing; Resend DPA in place |
| Font Awesome (Fonticons, Inc.) | Icon CDN serving | Global edge (US-headquartered) | EU SCCs (Module 3); Font Awesome DPA available; minimal Personal Data — IP address and User-Agent only via CDN logs |
| Railway Corporation | Cookie-scanner execution (automated website cookie/tracker scanning) | EU (Amsterdam) | EU SCCs (Module 3) via the Railway DPA — execution in progress; Railway Corporation is US-incorporated, so Chapter V applies notwithstanding EU-only processing in Amsterdam |
| Vercel Inc. | Evidence file & generated PDF document storage (Vercel Blob) | EU (Frankfurt) primary; global edge | EU SCCs (Module 3) for any US fallback; Vercel DPA in place |