// LEGAL · SUB-PROCESSORS
Sub-processors
Last updated: 2026-09-01
A sub-processor is a third party we engage to process personal data on behalf of a customer in the course of operating the Secure QR service. This page lists every sub-processor named in our Data Processing Addendum, and one entry that is not ours: when you connect an AI agent and grant it the content-read permission, payload content leaves our systems for the model provider that agent runs on. We do not engage or contract that provider — you select it, and it is your own sub-processor rather than ours — but the transfer is real, so it is disclosed here alongside the others. Our Privacy Policy and Data Processing Addendum describe that transfer in full. (pending registration), sole proprietorship, Singapore has not yet provisioned a production environment; rows marked with a pending region will be updated with the real value once that provisioning is complete, and no row on this page should be read as a claim that it is already live in production.
| Sub-processor | Purpose | Data category | Region |
|---|---|---|---|
| AWS KMS | Wraps and unwraps the per-tenant data-encryption keys used to encrypt every QR payload (envelope encryption master key). | Encryption key material | To be confirmed at production provisioning |
| Object storage (Cloudflare R2 or AWS S3-compatible) | Stores encrypted file payloads attached to a QR code. | Encrypted payload ciphertext | To be confirmed at production provisioning |
| PostgreSQL (system of record) | Stores all application data: ciphertext QR payloads, tenant and account records, hashed passwords, and encrypted user email. | Account and tenant data | To be confirmed at production provisioning |
| Redis / Valkey | Session cache (L1), rate limiting, gate-pass and magic-link tokens, and the background-job queue. | Session and rate-limit state | To be confirmed at production provisioning |
| Resend | Delivers transactional email: magic links, verification email, and account notices. | Email address and message content | Global (multi-region SaaS) |
| Polar | Merchant of Record for all paid plans: processes payment, collects and remits applicable tax, and issues invoices. | Billing and payment metadata | Global (multi-region SaaS) |
| Application hosting (web / api / worker compute) | Runs the web, api, and background-worker processes. | Infrastructure logs and metrics | To be confirmed at production provisioning |
| AI model provider used by a customer's own agent (customer-selected) | Not engaged by us and not under contract to us. When a customer grants an API key or MCP credential the qr:content:read scope, their agent can read decrypted QR payload content, and that content then leaves our systems for the model provider that agent runs on. The customer chooses that provider and is the controller of the transfer; we disclose the path, log every such read in the workspace audit trail, and cap it per credential per hour. No content reaches a model provider unless the customer grants that scope. | Decrypted payload content | Determined by the customer's own agent and model provider |
| Telemetry collector (OpenTelemetry / OTLP) | Optional request tracing and metrics export when OTLP_ENDPOINT is configured; the specific collector vendor is chosen at deploy time. | Infrastructure logs and metrics | To be confirmed at production provisioning |
Change notice
How we notify customers
We will give at least 30 days notice before adding or replacing a sub-processor that processes personal data covered by our Data Processing Addendum, so a customer has time to object under the terms of that Addendum before the change takes effect. Notice is sent to the account contact on file and posted on this page. Questions about a specific sub-processor or an upcoming change can be sent to (pending registration).