Subprocessors
The complete list of providers that process data on behalf of cymesh, with purpose, region and international transfer mechanism. It is versioned alongside the other legal pages: if a provider is added, removed, or changes region, the version goes up.
SupabaseProvider
- Purpose
- Authentication and database: account, hostnames, checks, incidents and alerts.
- Region
- South America — São Paulo, Brazil.
- International transfer
- None. The data stays within Brazil.
VercelProvider
- Purpose
- Hosting for the web application, execution of scheduled jobs, and aggregated audience measurement (Vercel Web Analytics, cookieless).
- Region
- Global network; request compute runs in the United States.
- International transfer
- Standard contractual clauses under the Vercel DPA.
ContaboProvider
- Purpose
- Server running the certificate and availability check workers.
- Region
- European Union.
- International transfer
- European Union adequacy decision, supplemented by a DPA.
StripeProvider
- Purpose
- Payment and subscription processing, in Brazilian reais and US dollars. Receives the account holder's name and email; card details are entered directly with Stripe and never pass through cymesh.
- Region
- United States.
- International transfer
- Standard contractual clauses.
ResendProvider
- Purpose
- Transactional email delivery — incident alerts, signup confirmation and password recovery — sent from the auth.cymesh.net subdomain.
- Region
- Brazil — São Paulo. Delivery runs on Amazon SES infrastructure in the sa-east-1 region.
- International transfer
- Message content is processed in a Brazilian region. Resend is a US company and administrative access to sending records happens in the United States, covered by standard contractual clauses.
CloudflareProvider
- Purpose
- Authoritative DNS for cymesh.net, routing of @cymesh.net email, and the Turnstile anti-abuse challenge on the signup screen. Turnstile receives the IP address and browser signals of whoever fills in the form.
- Region
- Global network.
- International transfer
- Standard contractual clauses.
What is not on this list
We use no ad networks, no data-enrichment services and no trackers that identify you across sites. We do not sell your data and we do not share it with third parties for their own purposes. Audience measurement is done by Vercel Web Analytics, without cookies and on aggregated data.
Changes to this list
Before adding a new subprocessor that handles personal data, we update this page and bump the legal pages version. If the change affects the region where your data is stored, we notify the account owner by email.