Sub-processors
Effective 2026-09-01
1. About this page
This is the canonical, maintained list of third-party sub-processors that Northline Ops engages to provide the Service. We will not materially change or add a sub-processor without updating this page.
If you wish to receive advance notice of sub-processor changes, email privacy@northlineops.com and we will notify you at least 14 days before any change takes effect. If you object to a new sub-processor on reasonable data protection grounds, you may terminate the Service within 30 days of notification as described in our Data Processing Agreement.
2. Current sub-processors
| Provider | Purpose | Data processed | Location | Attestations |
|---|---|---|---|---|
| Supabase | Sign-in and workspace data | Account details and workspace information. | United States | SOC 2 Type II, HIPAA eligible |
| Cloudflare R2 | Document storage | Files you upload; downloads are protected. | Global | SOC 2 Type II, ISO 27001 |
| Vercel | Website hosting | Information processed briefly while requests are handled; workspace data is not stored there. | United States / Europe | SOC 2 Type II |
| Stripe | Payment processing (international) | Payment amounts, invoice references, and customer email when provided. | United States / Europe | PCI DSS Level 1, SOC 2 Type II |
| Razorpay | Payment processing (India: cards, UPI, and netbanking) | Payment amounts, invoice references, and customer contact fields. | India | PCI DSS Level 1 |
| OneSignal | Browser push notifications (opt-in only) | Anonymous push subscription tokens and notification bodies you send. | United States | SOC 2 Type II |
| Upstash | Rate-limit protection | Limited information used to help prevent abuse; no workspace content. | United States / Europe | SOC 2 Type II |
| Your SMTP provider | Outbound email delivery (configured per workspace) | Only the messages you send through the service, configured in your email settings. | Depends on the provider you configure | Varies by provider |
3. Security attestations
Each sub-processor publishes its own independent security attestations under its own trust programme. Northline Ops does not itself hold SOC 2, HIPAA, or ISO 27001 certification. Our own security posture is described on the Security page.
4. Retired sub-processors
No sub-processors have been retired as of the effective date of this page. Retired providers will be listed here with their removal date and reason.
5. Updates
Last reviewed: September 2026. This page is reviewed whenever our service providers or vendor relationships change.
6. Contact
Questions about sub-processors: privacy@northlineops.com.