Sub-processors
Current as of 2026-07-30
These are the third parties that process data on behalf of Trusted Codes. The list carries its own date, because it changes when a supplier changes rather than when a contract does.
It is also Annex 2 of the Data Processing Agreement, and Section 12 of the Privacy Policy. All three are rendered from one source, so they cannot disagree.
Core service
Engaged for every customer of the hosted service.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Supabase | Database, authentication, server functions and file storage | European Union (Stockholm); operator established in the United States | All account, verification and billing data held by the service | Standard Contractual Clauses (2021/914) |
| Vercel | Hosting of the web portals and the public website | United States, with European edge regions | Request metadata: address of origin, user agent, requested path | Standard Contractual Clauses (2021/914) |
| Infisical | Custody of the keys that protect data at rest | European Union | Encryption keys only — no personal data | Inside the EEA |
| Stripe | Payment processing and subscription billing | Ireland and the United States | Billing name and address, tax identification number, subscription state. Card data never reaches Trusted Codes. | Standard Contractual Clauses (2021/914) |
| Resend | Delivery of transactional electronic mail | United States | Electronic mail address and message content, decrypted for the moment of sending | Standard Contractual Clauses (2021/914) |
| Expo | Relay of push notifications to the Apple and Google delivery services | United States | Push token and notification content | Standard Contractual Clauses (2021/914) |
| MaxMind | Fraud scoring and approximate location at sign-in | United States | Address of origin, electronic mail address, device signals | Standard Contractual Clauses (2021/914) |
| Google (Gemini) | Generating the answer of the in-app help assistant | United States | The question asked and the help articles retrieved for it | Standard Contractual Clauses (2021/914) |
| OpenAI | Turning a help question into a search vector, and indexing the help articles | United States | The question asked, and the text of the published help articles | Standard Contractual Clauses (2021/914) |
| Metabase | Analytics dashboards inside the administration console | Infrastructure operated by Trusted Codes | Aggregate figures queried from the service database | Operated by Trusted Codes |
Optional and user-chosen
Engaged only where the end user chooses the feature, or where the component is configured.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Apple | Sign-in, where the end user chooses it | United States | Name and electronic mail address, or the relay address Apple issues instead | Standard Contractual Clauses (2021/914) |
| Sign-in, where the end user chooses it | United States | Name and electronic mail address | Standard Contractual Clauses (2021/914) | |
| Sentry | Error monitoring in the mobile application | European Union (German region) | Error reports: stack trace, application version, device model | Inside the EEA |
Public website only
These handle visitors to trusted.codes, not users of the service.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Plausible Analytics | Visitor statistics for the public website | Infrastructure operated by Trusted Codes | Page requested and referrer, with no cookie and no identifier | Operated by Trusted Codes |
| Google (Sheets and Apps Script) | Receiving the website contact form and the waiting list form | United States | What the sender typed into the form | Standard Contractual Clauses (2021/914) |
| Sentry | Error monitoring for the website, where configured | European Union (German region) | Error reports: stack trace, browser, page | Inside the EEA |
A new sub-processor is announced at least 30 days before it begins processing, by electronic mail to the administrative contact of each business customer and by an update to this page.