Legal
Sub-processors
The complete list of third parties that process data on our behalf. If a company is not on this list, it does not touch your data.
Active sub-processors
These processors are engaged in production today. “Entity country” is where the processor itself is established, which is a different question from where your data is stored — a procurement review usually asks both, so both are listed.
| Sub-processor | Purpose | Data processed | Location | Entity country |
|---|---|---|---|---|
OVHcloud OVH SAS | Application hosting and database | All customer and end-user data at rest | Gravelines, France | France |
Cloudflare Cloudflare, Inc. | Authoritative DNS, TLS termination, CDN, and WAF | IP address, request metadata, and TLS-terminated request bodies in transit | Global edge network | United States |
Resend Resend, Inc. | Transactional email delivery | Email address, one-time codes, invite and password-reset links | eu-west-1 (Ireland) | United States |
Integrated but not active
Passura's codebase supports these services, but they are not configured in production and receive no data. They are listed so that the disclosure stays accurate if one is switched on, and their status here changes when that happens.
| Sub-processor | Purpose | Data processed | Location | Entity country |
|---|---|---|---|---|
Sentry Functional Software, Inc. | Application error tracking | Stack traces and request context, which may incidentally include user identifiers | Depends on configured region | United States |
Grafana Cloud Grafana Labs, Inc. | Log aggregation and alerting | Application logs, including IP addresses and request metadata | Depends on configured stack region | United States |
Notes on individual processors
- Cloudflare
- Applies to every passura.dev hostname, including api.passura.dev and app.passura.dev. Cloudflare terminates TLS, so authentication requests transit its edge. No customer data is stored at rest by Cloudflare.
- Resend
- The passura.dev sending domain is provisioned in Resend’s eu-west-1 region; the return path resolves to feedback-smtp.eu-west-1.amazonses.com. Mail content is processed in the EU by a US-established processor.
- Sentry
- Integrated but disabled in production — no DSN is configured, so no data leaves the host. Listed for completeness; this row moves to active if error tracking is switched on.
- Grafana Cloud
- Integrated but disabled in production — no Loki endpoint is configured, so logs stay on the host. Listed for completeness; this row moves to active if log shipping is switched on.
Changes to this list
We give 30 days’ written notice by email to every account’s registered address before a new sub-processor begins processing customer data. If you object within that window, you may terminate the affected service without penalty for the remainder of the current term.
This page is the authoritative version of the list. Changes are reflected here on the day the notice period begins, so the page and the notice never disagree.