Skip to main content
sentrytex
Start free

Sub-processors

Last updated: April 2026

Operated by: ClawNet (trading as Sentrytex), Germany

Sentrytex uses the following third-party services (sub-processors) to provide the Service. We require each sub-processor to maintain appropriate data protection standards, including entering into Data Processing Agreements (DPAs) with us that are no less protective than our obligations to you.

Current Sub-processors

ServiceProviderPurposeData ProcessedData LocationTransfer Mechanism
Authentication & DatabaseSupabase Pte. Ltd (Singapore)User accounts, authentication, stack selections, alert data storageEmail address, password hash (Supabase-managed), session tokens, usage logsData hosted in US-East (AWS us-east-1). The contracting entity and data importer is Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513.EU SCCs 2021/914 (Modules 2, 3) + UK Addendum (Version B1.0). Not certified under the EU-US DPF — Supabase publishes no DPF certification, so the SCCs stand alone. Its DPA applies Module 2 where we are the controller, and Module 3 where a customer is itself a processor and Supabase acts as a sub-processor.
Email DeliveryResend Inc.Transactional alert emails, receipts, and service notificationsEmail address, alert contentUnited States (primary delivery)EU SCCs 2021/914 (Modules 1, 2, 3) + UK Addendum + EU-US DPF + UK Extension to DPF
Payment ProcessingStripe Inc.Subscription billing and payment processingBilling email, payment method token (last 4 digits reference)United States (primary); EU/UK replicasEU SCCs 2021/914 (Modules 1, 2) + UK Addendum (Version B1.0) + EU-US DPF + Swiss-US DPF. Note: Stripe is an independent data controller for fraud detection and PCI compliance purposes.
Billing (Merchant of Record)Sold through Link, LLC (f/k/a Lemon Squeezy LLC), Salt Lake City, UtahMerchant of record for subscription sales — hosted checkout, payment processing, invoicing, sales-tax determination and remittance, refunds and chargebacksName, email address, billing address and country, payment method data (collected and held by Lemon Squeezy under its own PCI DSS programme — we never receive full card numbers), purchase and subscription history, Lemon Squeezy customer idUnited StatesEU SCCs 2021/914 (Modules 1, 2) + UK Addendum (Version B1.0). Not certified under the EU-US DPF: neither Lemon Squeezy's privacy notice nor its Data Processing Agreement claims DPF participation, so we rely on the SCCs alone for this transfer. As merchant of record, Lemon Squeezy is the seller of record and an independent data controller for its own tax, fraud-prevention and regulatory obligations.
Application HostingRailway Corp.Hosting the Sentrytex application backendAll transient request data processed during Service operationUS-West (GCP us-west2)EU-US DPF (primary) + UK-US DPF Extension + EU SCCs 2021/914 (supplementary) + UK IDTA
DNS & CDNCloudflare Inc.DNS resolution, edge caching, DDoS protectionIP address, user agent string (edge logs; not stored by Sentrytex)Global edge network; R2 origin USEU SCCs 2021/914 (Modules 2, 3) + UK Addendum (Version B1.0) + EU-US DPF
Error MonitoringFunctional Software, Inc. d/b/a SentryApplication error monitoring — capturing unhandled exceptions so we can diagnose, fix and prevent faults in the Service — plus server-side performance traces (request latency on our own backend; we run no performance tracing in your browser). Sentry's separate session replay feature is opt-in only and off unless the user enables it in our cookie banner.Error payloads and stack traces, request URL and browser/user-agent metadata, IP address, and — for signed-in users — the account's opaque Sentrytex user id, attached so an exception can be traced back to the affected account. No email address or name is sent to Sentry.Where, and only where, a user has opted in to session replay: a masked playback of that user's interactions with the page, with all text and form inputs masked and all media blocked.United States (Sentry US storage region)EU SCCs 2021/914 (Modules 2, 3) + UK Addendum (Version B1.0) + EU-US DPF + UK Extension to DPF + Swiss-US DPF
Rate Limiting & Traffic CountersUpstash, Inc. (a Delaware corporation)Abuse prevention — sliding-window rate limiting on authentication and waitlist endpoints — and cookieless aggregate traffic countingNo raw IP address is sent to Upstash. The client IP is hashed transiently in memory under a day-specific salt (HMAC-SHA256) and only the hash is stored, in two separate systems: rate limiting — a request counter under the hashed identifier, which exists only for the length of the limit window (15 minutes for authentication endpoints, 1 hour for the waitlist) and then expires; and traffic counting— a plain per-day pageview counter plus a HyperLogLog of the same salted per-day hashes, which expire after 35 days. No user agent, request path or per-visitor record is written in either system. Because the salt rotates daily, hashes cannot be correlated across days, and a HyperLogLog cannot be reversed to recover its inputs. The rate-limiter's optional usage analytics — which would log the raw identifier and coarse location for 90 days — is disabled.United States (Upstash, Inc. is the recipient of European data in the US under its own DPA)EU SCCs 2021/914 (Modules 1, 2) + UK Addendum (Version B1.0) + EU-US DPF + UK Extension to DPF
Product AnalyticsPostHog Inc.Page-view and feature-usage analytics (opt-in)Anonymous device identifier, page URL, event metadata. No payload PII.EU (Frankfurt) — PostHog Cloud EUEU SCCs 2021/914 (Modules 1, 2) + UK Addendum + EU-US DPF
Web AnalyticsGoogle LLC (Google Analytics)Aggregate web analytics — page-views and feature usage (opt-in only; off by default)Usage events, page URL, device/browser data, approximate location via anonymised IP. No payload PII.United StatesEU SCCs 2021/914 (Module 2) + UK Addendum + EU-US DPF
Privacy-Preserving RUMCloudflare Inc.Aggregate page-view counts via Cloudflare Web Analytics (cookieless, no fingerprinting, no consent gate required)None retained on a per-visitor basis: aggregated page URL, referrer, country, and bot/non-bot classification only. No cookies, no device IDs.Global edge networkEU SCCs 2021/914 (Modules 2, 3) + UK Addendum (Version B1.0) + EU-US DPF
Internal Signup NotificationsDiscord Inc.Posting a “new signup” message to our own internal operations channel so the team sees account growth in real timeA truncated one-way keyed hash of the account identifier, the plan name, the signup method (Google / magic link / password) and a timestamp. No email address, name, IP address or raw account id is sent. The hash is not reversible and cannot be linked back to an individual by Discord.United StatesEU SCCs 2021/914 (Modules 1, 2) + UK Addendum (Version B1.0) + EU-US DPF + UK Extension to DPF + Swiss-US DPF

Note on Slack.Where a customer configures Slack webhook delivery for alerts, alert data is transmitted to that customer's own Slack workspace via the incoming-webhook URL the customer supplies. Slack Technologies, Inc. is the customer's processor for that destination, not ours — Sentrytex acts solely as a dispatcher to a customer-provided endpoint — so Slack is not a Sentrytex sub-processor. See section 2.4 of our DPA.

Note on our cookie banner. Sentrytex's consent banner is rendered by Klaro, an open-source JavaScript library (Apache 2.0) bundled with our application and served from our own domain. Klaro runs entirely in your browser and is not a sub-processor — no consent record, identifier, or other data leaves your device.

Transfer Mechanisms: Key

  • EU SCCs 2021/914: Commission Implementing Decision (EU) 2021/914 of 4 June 2021: Standard Contractual Clauses for the transfer of personal data to third countries under the GDPR.
  • UK IDTA: International Data Transfer Agreement (Version B1.0), issued by the UK Information Commissioner under the Data Protection Act 2018 for UK-origin international transfers.
  • UK Addendum: UK Addendum (Version B1.0) to the EU SCCs; converts the EU SCCs into a UK-compliant transfer mechanism for EEA + UK dual coverage.
  • EU-US DPF: EU-US Data Privacy Framework, an adequacy mechanism adopted by the European Commission in July 2023.
  • UK Extension to DPF: UK Extension to the EU-US Data Privacy Framework; UK adequacy mechanism covering UK → US transfers.
  • Swiss-US DPF: Swiss-US Data Privacy Framework, an adequacy mechanism for Switzerland → US transfers.

Sub-processor Changes

We review our sub-processor list regularly. We will notify customers of any material additions or replacements at least 30 days in advance by email to the address associated with your account.

If you object to a new sub-processor on data protection grounds, please contact [email protected] within 14 days of the notification. We will work to accommodate reasonable objections where operationally feasible.

DPAs and SCC Copies

Copies of applicable Sub-processor DPAs and Standard Contractual Clauses are available on request at [email protected].

Sub-processor DPA links for reference:

Contact

For sub-processor and data protection queries: [email protected]