Subprocessors
Third parties that process personal data on Praxa Lab's behalf to operate the Caputchin service. State-bearing data lives in EU regions (database, hosting, transactional email). Stripe processes payment data on its global infrastructure regardless of contracting entity, but Praxa Lab never receives or stores card numbers. GitHub and Google OAuth is user-initiated at sign-in.
| Subprocessor | Location | Purpose |
|---|---|---|
| Cloudflare | EU regions | Hosting (Workers, R2, Hyperdrive, Containers) |
| Supabase | EU (Frankfurt) | Postgres database for all state |
| Stripe | Stripe Payments Australia Pty Ltd (Sydney). Payment processing on Stripe's global infrastructure. | Billing and payments. Praxa Lab never receives card numbers. |
| Resend | EU region | Transactional email (sign-in links, security notices) |
| GitHub | US / global | OAuth sign-in (only when user chooses it) |
| US / global | OAuth sign-in (only when user chooses it) |
Changes
Paying customers receive at least 30 days advance notice by email and dashboard banner before any subprocessor is added or changed. Customers may terminate their paid plan without penalty during the notice window if they object.