A subprocessor is a company we use to run SpoolStream that may process personal information our customers send through the service. This page lists them, says what each receives and where, and how we announce a change. It is Annex 1 of the data processing addendum.
The hosted service runs in Toronto on DigitalOcean (App Platform for the application, managed PostgreSQL for the database), with Cloudflare for its domain name and Cloudflare R2 for documents. Payments through Stripe and monitoring on Grafana Cloud are planned and not switched on.
The list
| Provider | What it does for us | What it receives | Where | Status |
|---|---|---|---|---|
| DigitalOcean | Runs the application: the API, the dashboard and the background worker | Everything the application processes, in memory and in its logs | Toronto, Canada | In use |
| DigitalOcean | The managed PostgreSQL database | Everything the service stores in its database: accounts, jobs and their history, audit trail | Toronto, Canada | In use |
| Cloudflare | The domain name; storage of documents (R2) | The documents while they are kept; the names of the service's addresses | The application and the database run in Toronto, Canada. The region of the document store is not chosen: the store (Cloudflare R2) gives no guarantee that documents stay in Canada. | In use |
| Amazon Web Services (Amazon SES) | Sends the service's emails | Recipient addresses, names, and the content of the emails (codes, invitations, notices) | Canada (Central) | In use |
| Stripe | Payments and invoices | The billing contact and payment method, entered on Stripe's own pages; the organization's identifier; one total per counted quantity per period | United States and elsewhere | Planned, not switched on |
| Grafana Labs (Grafana Cloud) | Monitoring of the service | Metrics without any person or organization; redacted logs | Not chosen | Planned, not switched on |
The service sends its emails (confirmation codes, invitations, password resets, deletion notices) over SMTP through Amazon SES, in the Canada (Central) region.
In the designed hosting, Cloudflare carries all the traffic to the service and ends TLS, so it can read API traffic, cookies and the signed document links; the documents themselves are stored in Cloudflare R2.
Payment cards are entered on Stripe's own pages: no card data reaches SpoolStream. Stripe receives a customer record carrying the organization's identifier, and one total per counted quantity for each closed period.
Not subprocessors. Google and Microsoft receive information only when a person chooses to sign in with them, under their own terms. Your own computers, printers and print servers are yours.
Changes
We tell the owners of each organization by email at least 30 days before we add or replace a subprocessor. Write to [email protected] with any question.