AlpacaKeep
Get early access
Sub-processors

Sub-processors

We process customer data with the help of a small set of third-party services, each bound by a Data Processing Agreement under GDPR Art. 28. The list below is exhaustive - we add nothing else without updating this page first.

Last updated: 17 June 2026

1. Active sub-processors

These providers process customer data today.

Supabase Inc.

  • Role: Database, authentication, and file storage
  • Region: Frankfurt, Germany (EU)
  • Transfer: No transfer outside the EEA via this processor.
  • Data Processing Agreement ↗

Vercel Inc.

  • Role: Application hosting, CDN, Web Analytics, and Speed Insights
  • Region: Edge functions pinned to fra1 (Frankfurt)
  • Transfer: Web Analytics and Speed Insights operate in cookieless mode (no device storage; visitor identification via server-side request hash, discarded after 24 h). Some platform telemetry processed in the United States under EU Standard Contractual Clauses.
  • Data Processing Agreement ↗

Cloudflare Inc.

  • Role: DNS resolution for alpacakeep.com
  • Region: Global anycast network
  • Transfer: No application data stored; processes only DNS queries.
  • Data Processing Agreement ↗

Heinlein Hosting GmbH (Mailbox.org)

  • Role: Email hosting for @alpacakeep.com mailboxes
  • Region: Berlin, Germany (EU)
  • Transfer: No transfer outside the EEA via this processor.
  • Data Processing Agreement ↗

Umami Software, Inc.

  • Role: Privacy-friendly website analytics for the public marketing pages only (the signed-in app is not tracked)
  • Region: European Union (Umami Cloud EU data region, Germany)
  • Transfer: Cookieless: no cookies, no device storage, and no IP address is stored. The visitor’s IP and user-agent are processed transiently to count anonymous visits, then discarded. The account’s data region is set to the EU, so analytics data is stored in the European Union — no transfer outside the EEA via this processor.
  • Data Processing Agreement ↗

2. Planned sub-processors

These providers are not yet active. They will move to Section 1 before they begin processing customer data.

  • Sentry - error tracking (planned for Phase B; EU cluster).
  • Axiom - structured application logs (planned for Phase B).
  • Better Uptime - health checks for the public status page (planned for Phase B).
  • Stripe - SaaS billing (planned for Phase C, when paid plans launch).
  • Resend - transactional email (planned for Phase C).

3. Notification of changes

We update this page before any new sub-processor begins processing customer data. Customers can request advance notification of changes by emailing privacy@alpacakeep.com; once Phase C launches we will offer an email-subscription option.