Subprocessor List
Version: subprocessors-2026-09-05-v1
Effective date: 6 September 2026
Status: published
This list supports the Data Processing Agreement. It distinguishes services that may process Customer Personal Data from providers used mainly for data for which Orsta is controller.
| Provider | Service and data processed | Processing locations and safeguards |
|---|---|---|
| Supabase | Authentication and database hosting for account data and Customer Data | Primary database and authentication hosting in London, UK. Provider administration, security and support may involve other countries under its DPA and transfer safeguards. |
| Railway | API and background processing, including uploads, exports, Customer Data, job metadata and operational logs | Application hosting in Amsterdam, Netherlands. Railway also operates in the United States; its DPA includes the UK Addendum for restricted transfers. |
| Cloudflare | Website and application delivery, DNS and security; request metadata and Customer Data passing through the API | Global network. Its DPA includes transfer safeguards; its subprocessor list identifies service and support locations. |
| Resend | Authentication email delivery, including recipient addresses, message content and delivery metadata | EU sending region, with subprocessors in other countries including the United States. Its DPA includes the UK Addendum and the UK Extension to the EU-US Data Privacy Framework. |
| Google Workspace | Business email, including support, privacy and contractual correspondence and content supplied by customers | Processing and support may involve several countries under Google's Cloud Data Processing Addendum. Customer-initiated support access to Customer Data requires Orsta's authorisation. |
Retention
- Database backups have a seven-day retention period. The DPA explains how backup deletion follows production deletion.
- Railway operational logs are retained for seven days.
- Cloudflare DNS analytics has eight days of history. Orsta does not use Cloudflare as a long-term store of detailed HTTP logs.
- Resend email data is retained for 30 days. Authentication emails are not intended to contain uploaded financial content.
- Business correspondence follows the periods in the Privacy Notice. Deleted Gmail messages remain in Trash for 30 days, followed by a limited administrator recovery period.
Some listed providers also process data for which Orsta is controller. Their appearance here does not mean every activity is subprocessing on Customer's behalf.
Changes and objections
Orsta will update the version and notify affected customers of an intended new or replacement subprocessor in accordance with the DPA. Customers may object on reasonable data-protection grounds during the notice period.
Questions and objections: privacy@orsta.app
Address: Orsta Ltd, Suite RA01, 195-197 Wood Street, London, United Kingdom,
E17 3NU. Registered in England and Wales, company number 17403586.