Subprocessors
Third-party service providers that process customer data on behalf of Noodlbox
Noodlbox uses the following third-party service providers ("subprocessors") to deliver our services. These providers are bound by data protection requirements and process customer data only as necessary to provide their respective services.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting (ECS Fargate, SQS) | All service data, API traffic, background job processing | United States |
| Cloudflare | CDN, WAF, DDoS protection, object storage (R2), DNS | API traffic, code artifacts (R2), edge caching, security logs | Global (R2 storage: Western Europe) |
| Neon | PostgreSQL database hosting | Account data, organization data, box metadata, audit logs, API keys | United States |
| WorkOS | Authentication and identity management | User profiles, email addresses, organization memberships, session data | United States |
| Vercel | Web application hosting (landing, dashboard, docs) | Web traffic, server-side rendering, edge functions | Global |
| Polar | Subscription billing and payments | Billing information, subscription status, payment events | United States |
| Resend | Transactional email delivery | Email addresses, email content (receipts, notifications) | United States |
| PostHog | Product analytics (consent-based) | Anonymized usage events, feature adoption metrics. Requires cookie consent on the marketing site. | United States |
| Sentry | Error tracking and monitoring | Error reports, stack traces, request metadata. No customer code is sent to Sentry. | United States |
| Axiom | Observability (traces, logs) | API request traces, structured logs, performance metrics. May include request IDs correlated with user actions. | United States |
Updates
We will update this page when subprocessors are added or removed. Material changes will be communicated via email to registered users at least 30 days before the change takes effect.
Contact
For questions about our subprocessors or to request a Data Processing Agreement (DPA), contact security@noodlbox.io.