Sub-processors
Active Sub-processors
The following sub-processors are currently used by Koffyr in production. This list is the authoritative register for DPA Schedule 3 purposes.
| # | Sub-processor | Service | Data Categories | Region | Transfer Mechanism |
|---|---|---|---|---|---|
| 1 | Amazon Web Services, Inc. | Cloud compute (ECS Fargate), PostgreSQL (RDS), object storage (S3), KMS (PII encryption keys), AppSync (real-time pubsub), ElastiCache (session cache) | All Personal Data processed by the platform; all Customer Data stored in S3 and RDS | United States (us-east-2) | SCCs / AWS DPA |
| 2 | Cloudflare, Inc. | CDN, WAF, DDoS protection, Cloudflare Pages (koffyr-web frontend hosting), Custom Hostnames (SaaS vanity domains) | IP addresses, HTTP request metadata, DNS records for custom domains. For US-based customers, all origin data is stored in AWS us-east-2; Cloudflare processes only request metadata at edge nodes and does not store Personal Data. | Global CDN; HQ United States | SCCs |
| 3 | Twilio Inc. (SendGrid) | Transactional email delivery (COI issuance notifications, magic-link OTPs, invite emails, reminder emails) | Recipient email addresses, email content, delivery event metadata | United States | SCCs |
| 4 | Mixpanel, Inc. | Product analytics: platform usage events | Anonymous user IDs (opaque UUID); event names; event metadata. PII is NOT sent to Mixpanel (code-verified). | United States | SCCs |
| 5 | Functional Software, Inc. (Sentry) | Application error monitoring and performance tracing | Exception messages, stack traces, request IDs, user agent strings, IP addresses (configurable scrubbing); 90-day retention | United States | SCCs |
| 6 | Stripe, Inc. | Payment processing, subscription billing, billing portal | Organization billing identifiers (Stripe customer ID, billing email); payment card data is handled entirely by Stripe and never reaches Valtio servers | United States | SCCs |
| 7 | Entrust, Inc. (Timestamp Authority) | RFC 3161 timestamp authority for e-signatures (timestamp.entrust.net); AATL-listed (Adobe-trusted) |
Document hashes only (SHA-256) — no document content or Personal Data transits; timestamps are public RFC 3161 tokens | United States | Minimal / likely N/A — only opaque hashes transit (no Personal Data); governed by the Entrust ECS Time-stamp Practice Statement |
| 8 | Better Stack, Inc. | Log aggregation and uptime monitoring | Server logs (request metadata, IDs), uptime metrics; 12-month log retention | United States | SCCs |
Change Notification
We review this sub-processor list quarterly. When we add or remove a sub-processor, workspace Owners will receive email notification at least 30 days in advance of any new sub-processor going live.
If you object to the addition of a new sub-processor on reasonable data protection grounds, you may terminate the affected portion of the Service in accordance with the DPA Section 7.2.
Data Residency
All primary production data resides in AWS us-east-2 (United States), with recovery points retained in an immutable in-region backup vault. Cloudflare's CDN processes request data globally at edge nodes.
No explicit data residency commitments (EU/UK) are currently in place. Per-region data-residency commitments are deferred post-pilot.
For EEA/UK customers: international data transfers to US-based sub-processors rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms. See DPA § 8.