Guide
Sub-processors
Draft under legal review
This list is part of a draft that is not in force yet and may still change. Highlighted brackets mark points that are still open.
These are the sub-processors hyad uses to provide its service, as listed in Annex B of the Data Processing Agreement. App owners get at least 30 days' notice by email, at their account address, before hyad adds or replaces a sub-processor that receives App Data (DPA, section 6).
| Sub-processor | Service | Receives App Data? | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. (US) | All hosting: Workers (app code), Durable Objects (app databases), R2 (app files, their backup copies, and bundles), D1 (access lists), DNS, TLS, custom hostnames, Turnstile, logs; Email Service for hyad's own sign-in and notice mails (apps cannot send mail through it) | Yes, all App Data | EU for storage at rest (section 7); processing at the edge worldwide | DPF / SCCs [[CHECK]] |
| GitHub, Inc. (US) | Private source repository for each app | Only if the app's source code or files in it contain personal data | US [[CHECK]] | DPF / SCCs [[CHECK]] |
| Mail provider | Cloudflare Email Service (above). The documented fallback, Resend, is not in use | No | — | — |
Not sub-processors, because they receive no App Data: Stripe (payments; hyad is controller for
billing data) and Google's Gmail, to which support@hyad.app is forwarded. Support is account
support, for which hyad is controller (see the Privacy Policy). Do not send
App Data to support by email; if support needs to look at App Data, it does so inside hyad.
[[CHECK: if support ever receives App Data by email, Google (Gmail) must be listed here as a sub-processor again]]
The current list is published at https://hyad.app/legal/subprocessors. hyad emails every
Customer at least 30 days before a change (section 6).