Subprocessors

Last updated 12 August 2026.

Running Excubia means a handful of suppliers touch the data you put in. They act on our instruction, they may not use it for anything of their own, and each of them is bound by a data processing agreement with us.

This page is the list the data processing agreement refers to. It changes when a supplier is added or replaced, and we tell you before that happens.

Who they are

Vercel — hosting for the website and the app.

What they see: everything that passes through a request, including anything you type into the app.
Where it runs: our code runs in Vercel's Dublin region. Static files are cached on their global network.
Transfer: Vercel is a US company. Their agreement with us uses the 2021 standard contractual clauses, module two.
Their own list: security.vercel.com

Supabase — database, login and background jobs.

What they see: everything stored in Excubia — clients, sites, agreements, tasks, comments, hours, and the accounts themselves.
Where it runs: Ireland, region eu-west-1.
Transfer: Supabase is a US company. Their agreement with us uses the standard contractual clauses, module two.
Their own list: supabase.com/legal/customer-resources/subprocessor-list

Cloudflare R2 — storage for file attachments.

What they see: the files you attach to a task, and nothing else.
Where it sits: Cloudflare's EU jurisdiction, which keeps the files inside the EU rather than wherever is nearest.
Transfer: Cloudflare is a US company. They are certified under the EU-US Data Privacy Framework, and their agreement with us also carries the standard contractual clauses.
Their own list: cloudflare.com/gdpr/subprocessors

Resend — sending email.

What they see: the recipient's address and name, and what the message is about — a task title, a project name, who did something. Never the contents of a comment.
Where it sits: our mail is sent from their Irish region, but Resend stores the send log in the United States. It is kept for 30 days.
Transfer: Resend is certified under the EU-US Data Privacy Framework including the UK extension, and their agreement with us carries the EU standard contractual clauses, module two.
Their own list: resend.com/legal/subprocessors

Where the data actually is

Three of the four keep the data in the EU. The exception is Resend's send log — the recipient address, the subject and the time — which sits in the United States. That is the only routine flow of personal data out of the EU, and it is covered by both of the mechanisms above.

All four suppliers are US companies, so their staff can in principle reach the data while supporting the service, even where it is stored in the EU. That is why the transfer basis is listed for each of them and not only for Resend.

What is not on this list

Dinero and Slack are not our subprocessors. They run on your own accounts under your own agreements with them. When you connect one, you are instructing us to send data there, and what happens at their end is between you and them. We list them here because you should know the data moves, not because we are the ones processing it.

Plausible is not one either, and for a different reason. They count visits on our public pages — the front page and these documents — and never touch anything you or your clients put into Excubia. That makes them a supplier for our own visitor statistics rather than someone processing your data on your behalf, which is what this list is for. They set no cookies, they are an Estonian company, and the data stays in the EU. What they do see is described in the privacy policy.

Changes

We tell you before a new supplier starts processing anything, and you have 30 days to object. If we cannot find a way around your objection, you can end the agreement for the part of the service it affects, and we will not charge you for the time you did not get.

The date at the top says when this page last changed. Every earlier version is kept in our source repository.