Sub-processors

Last updated 11 September 2026

The complete list of third parties that handle data on our behalf. It is short on purpose: every name here is somewhere your data can go, so adding one is a decision rather than a convenience.

Current sub-processors

Provider	What it does	What it receives	Where
Neon	Hosts the application database	Account details, business details, events, templates, session records, audit history. No photographs.	Sydney, Australia
Cloudflare (R2)	Stores files	Photographs taken at events, uploaded design assets, and event exports	Oceania
Amazon Web Services (Lightsail)	Runs the API and background jobs	Everything above, in transit and in memory while a request is served	Sydney, Australia
Cloudflare (Workers, CDN, DNS)	Serves this website and the portals, and routes API traffic	Request metadata and page content in transit	Global network
Stripe	Processes subscription payments	Your name, email, billing details and card data, which you enter with Stripe directly	United States
Resend	Delivers transactional email	The recipient's email address and the contents of the message	United States
Sentry	Reports faults in the API and background jobs so we can fix them	Error messages and the code path that failed. Configured to send no request bodies, cookies, user identifiers or addresses, and it never receives photographs	European Union
UptimeRobot	Checks from outside that the service is answering	Nothing. It requests a health address every five minutes and reads the response code	United States

Worth knowing

Photographs are only ever in one place. They are stored in Cloudflare R2 in the Oceania region and referenced from the database by key. No other provider on this list holds them.
Card numbers never reach us. Payment details are entered with Stripe and stay with Stripe. We hold only the identifiers that link your account to your subscription.
The primary copy of your data is in Australia. Only Stripe, Resend and Sentry are outside it — for payments, email and fault reports respectively — and Sentry's copy is kept in the European Union.
There is no analytics or advertising provider on this list, because there is not one in the product.

Changes to this list

We will update this page before a new sub-processor starts handling customer data, and email account holders to tell them. If a customer objects to a new sub-processor on reasonable grounds, they may raise it with us under clause 6 of the Data Processing Agreement.

Questions about anything on this page: help@boothiva.com