DPA (Data Processing Agreement)SubprocessorsPrivacyTermsRefunds

Subprocessors

The companies we use to process personal data on your behalf. Three today: Oracle Cloud in Canada, Cloudflare at the edge, and Stripe for billing.

Version
v1.0
Effective
15 Sep 2026
History
last updated 17 Aug 2026
Previous versions
none — v1.0 is the first in force

1. The list

A subprocessor is a company YS Progress Inc. engages to process personal data on your behalf under DPA §9. These are all of them.

PROCESSORPURPOSELOCATIONSCOPE
Oracle CloudAll infrastructure, storage, platform emailca-toronto-1, Canadaat rest
CloudflareCDN, WAF, DNS, TLS termination — sees all HTTP traffic in transit. R2 object storage holds encrypted backup snapshots (encrypted before upload; keys held by YS Progress)Global edgetransit + encrypted backups
StripePayments — billing data only, never message contentUSbilling data only

Oracle Cloud processes Customer Personal Data in Canada, which holds adequacy findings from the EU, the UK and Switzerland. Transfers to Cloudflare and Stripe rely on their certification under the EU–US Data Privacy Framework or on Standard Contractual Clauses, as DPA §8 describes.

2. Changes, notice and objections

An addition or replacement is dated in the change log below and emailed to account owners at least 30 days before the new subprocessor processes Customer Personal Data — the dated log is what makes that commitment checkable. The only exception is an urgent replacement needed for security, continuity or legal compliance, announced as soon as reasonably practicable. Objections go to [email protected] within the notice period; DPA §9 sets out what happens next.

3. Change log