Subprocessors.

A complete list of third parties that process merchant data on TrackLayer's behalf. We notify the email on file fourteen (14) calendar days before adding a new subprocessor. Subscribe to updates via RSS: /subprocessors.rss.

§ 01

Current subprocessors.

PROCESSORPURPOSEREGIONEFFECTIVE DATE

Cloudflare

→ DPA

CDN and WorkersEU and US2026-04-27

Supabase

→ DPA

Database and authenticationEU2026-04-27

Resend

→ DPA

Transactional emailUS2026-04-27

OpenAI

→ DPA

LLM featuresUS2026-04-27

Anthropic

→ DPA

LLM featuresUS2026-04-27

Stripe

→ DPA

Billing and paymentsUS and EU2026-04-27

§ 02

Change log.

2026-03-12Added: Resend as transactional email provider (replacing Postmark)

2025-11-04Removed: Postmark · migration complete

2025-06-18Added: Anthropic API (AI features, opt-in per merchant)

2024-04-09Initial subprocessor list published

§ 03

Stay notified.

The billing-contact and legal-contact emails on file automatically receive at least fourteen (14) days' notice of new subprocessors. Update these in Settings → Account.

RSS

For programmatic updates, subscribe to /subprocessors.rss. Every addition, removal, or region change appears as a new entry.

Data Processing Agreement

EU-standard SCCs incorporated by reference. Sign online.

Security Whitepaper

Deep technical dive into architecture, controls, and audit mechanisms.

Security & Compliance Hub

Full overview of audit logs, residency, consent, and certifications.