Sub-processors
Last updated: 2026-09-05
These are the sub-processors OpenDQV Cloud uses to provide the Service, as authorised under our Data Processing Agreement §6. We will notify account holders by email at least 30 days before adding or replacing a sub-processor; if you do not accept the change, you may cancel under the Terms of Service before it takes effect. Every change to this list is recorded in the dated change log below.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| Cloudflare, Inc. | Web app hosting, request routing, and coordination (control plane) | Account data — name, email, company and the onboarding profile you provide (Privacy Policy §2.1) — plus aggregate usage counts, the signup-attempt log (30 days) and control-plane operational logs (7 days; Privacy Policy §2.4) — never validation content | Global edge network for request routing (see Privacy Policy §7 on transit); the control-plane database is currently served from Cloudflare’s Western Europe region — no storage-region setting is offered, so this is stated, not contractually committed (Privacy Policy §2.1) |
| AWS / Microsoft Azure / Google Cloud (the provider of the region you selected) | Infrastructure for your engine and audit trail | Your validation processing and audit metadata, in your selected region only | The cloud region you selected at signup — fixed for the life of your account |
| Amazon Web Services (contract definition store) | Object storage for your contract definitions — the YAML you author — whichever cloud runs your engine | Your contract definitions (configuration, never validation content) | The jurisdiction you selected at signup — Ireland for EU, London for UK, N. Virginia for US; fixed for the life of your account |
| Stripe, Inc. | Payment processing | Billing details — no validation data | United States / global (Stripe’s own compliance framework applies) |
| Resend, Inc. | Transactional email — sign-in links, account, billing and lifecycle notices | Account holder names and email addresses — no validation data | United States |
Change log
- 2026-09-05Cloudflare entry expanded to match Privacy Policy §2.1 and §2.4: the onboarding profile, the signup-attempt log and control-plane operational logs are named as data categories, and the control-plane database location is stated. A disclosure correction — no new sub-processor, no new data flow.
- 2026-09-01This page created as the canonical, dated sub-processor list, linked from Privacy Policy §4 and DPA §6.
- 2026-08-30Resend added to the published list in the Privacy Policy and DPA. Correction of an omission, not a new engagement: Resend has delivered our transactional email since April 2026 and was missing from the published list between then and this date. No paying customer was affected — the omission window predates our first paid account; during it, Resend processed the names and email addresses of trial signups (the same limited data it is disclosed for today), and no validation data at any point.
- 2026-08-27Data Processing Agreement published, carrying the sub-processor list with 30-day advance-notice and objection rights (§6).
- 2026-04-02Initial processor list published in the Privacy Policy: Cloudflare, the selected cloud provider, Stripe.
OpenDQV Cloud — Terms of Service · Privacy Policy · Data Processing Agreement