DPA (Data Processing Agreement)SubprocessorsPrivacyTermsRefunds

Subprocessors

The companies we use to process personal data on your behalf. Three today: Oracle Cloud in Canada, Cloudflare at the edge, and Stripe for billing.

Version
v1.1
Effective
30 Sep 2026
List last changed
last updated 17 Aug 2026
Previous versions
v1.0, in force 15–29 Sep 2026

1. The list

A subprocessor is a company YS Progress Inc. engages to process personal data on your behalf under DPA §9. These are all of them.

PROCESSOROracle CloudPURPOSEAll infrastructure, storage, platform emailLOCATIONca-toronto-1, CanadaSCOPEat rest
PROCESSORCloudflarePURPOSECDN, WAF, DNS, TLS termination — sees all HTTP traffic in transit. R2 object storage holds encrypted backup snapshots (encrypted before upload; keys held by YS Progress)LOCATIONGlobal edgeSCOPEtransit + encrypted backups
PROCESSORStripePURPOSEPayments — billing data only, never message contentLOCATIONUSSCOPEbilling data only

Oracle Cloud processes Customer Personal Data in Canada, which holds adequacy findings from the EU, the UK and Switzerland. Transfers to Cloudflare and Stripe rely on their certification under the EU–US Data Privacy Framework or on Standard Contractual Clauses, as DPA §8 describes.

2. Changes, notice and objections

An addition or replacement is dated in the change log below and emailed to account owners at least 30 days before the new subprocessor processes Customer Personal Data — the dated log is what makes that commitment checkable. The only exception is an urgent replacement needed for security, continuity or legal compliance, announced as soon as reasonably practicable. Objections go to [email protected] within the notice period; DPA §9 sets out what happens next.

3. Change log

17 Aug 2026Stripe listed as live — payments are processed; billing data only, never message content. Pre-announced 2 Aug, so 15 days' notice, not the 30 this page's §2 (and DPA §9) promise. No DPA had been countersigned, so no controller was owed notice — said here rather than left to arithmetic. The next addition runs the full 30.
2 Aug 2026Cloudflare listed — clarified as TLS-terminating transit subprocessor on the Security page and here, same day.
2 Aug 2026Stripe pre-announced as planned payments subprocessor — 30-day notice will run before it goes live.
2 Aug 2026Initial list published: Oracle Cloud (ca-toronto-1) as sole infrastructure subprocessor.