Subprocessor List
Draft list of the providers UpPage is built to use. None is under contract yet; a provider is listed as active only once it is configured in production.
Core providers (planned)
Render: application hosting and background jobs. All service data passes through it.
Supabase: Postgres database, authentication (Google, GitHub and email sign-in links), and storage of published status page snapshots.
Stripe: sells UpPage subscriptions as merchant of record through Stripe Managed Payments (test mode only so far). Stripe is the seller on the invoice, collects and remits sales tax and VAT, and receives billing details directly; UpPage does not store card data.
Optional providers (used only when configured)
Resend: sends alert emails to the addresses a customer chooses, and invitations. Receives recipient addresses and message content.
TypeSafe (Jev): screens page addresses, names, descriptions, new accounts’ incident text and abuse-report text for phishing and impersonation. Account emails, credentials and monitoring data are not sent. Scores only add a review hold or order the queue; a person decides.
Google Web Risk: checks UpPage’s own domains and public page URLs against Safe Browsing lists. Receives URLs only.
External uptime monitor (proposed Better Stack): checks UpPage’s own health endpoint and pages the operator. Receives no customer data.
Not subprocessors
Slack workspaces and webhook endpoints that a customer configures are the customer’s own destinations. UpPage sends them notifications on the customer’s instruction. Cloudflare provides DNS for UpPage’s domains and does not proxy customer page traffic.
Changes and details
TODO: for each active provider, legal entity, processing region, DPA and transfer basis; how customers are notified of changes, the notice period, and the objection process.