Subprocessor List
Last updated: 2026-04-24
Ruunly uses the vendors below to help us deliver the service. This list is incorporated by reference into Ruunly's Data Processing Addendum. Under GDPR Art. 28, we'll give tenants notice at least 30 days before onboarding any new subprocessor and honor timely written objections.
Every vendor below is under a written data processing agreement (or equivalent) with Ruunly. Card primary account numbers (PANs) never touch Ruunly servers or any vendor other than Stripe.
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, Stripe Connect, subscription billing | Customer name, email, billing address, card/bank tokens, transaction amounts | United States |
| Supabase, Inc. | Authentication (email + magic link), session management | Authentication credentials, email, session metadata | United States |
| Cloudflare, Inc. | CDN, DDoS protection, Cloudflare R2 file storage, custom-domain SaaS | Request metadata (IP, headers), file uploads (signed URLs), DNS | United States |
| Vultr Holdings, LLC | Application hosting (Miami region) | All application data at rest (encrypted) | United States |
| Resend (Resend.com, Inc.) | Transactional email delivery (primary) | Recipient email, email content, delivery metadata | United States |
| SendGrid (Twilio, Inc.) | Transactional email delivery (fallback) | Recipient email, email content, delivery metadata | United States |
| Telnyx, LLC | SMS delivery (primary) | Recipient phone number, message content, delivery status | United States |
| Twilio, Inc. | SMS delivery (fallback) | Recipient phone number, message content, delivery status | United States |
| PostHog, Inc. | Product analytics (consent-gated) | Consent-based event telemetry: page views, feature usage; anonymized via distinct IDs | United States |
| Inngest, Inc. | Background job scheduling and retry infrastructure | Event payloads (may include tenant and customer IDs; no card PAN) | United States |
| Sentry (Functional Software, Inc.) | Error tracking and diagnostics (PII scrubbed) | Error stack traces, request metadata with PII automatically scrubbed | United States |
| OpenWeatherMap | Weather data (powers weather alert automation) | Geographic coordinates (for weather lookup; no customer identifiers) | United Kingdom |
| Namecheap, Inc. | Domain registration (managed domains on Pro/Growth tiers) | Domain registrant details (owner-provided) | United States |
| Anthropic, PBC | AI content generation (website copy, review response drafts, blog assistance) | Prompts we construct from tenant input; no card or health data; model runs are not used for training per API terms | United States |
| Intuit, Inc. (QuickBooks Online) | Accounting sync for tenants who opt in (Growth tier) | Invoice metadata, payment amounts, customer names — sent only if tenant connects QBO | United States |
Notice of changes. When we plan to add a new subprocessor, we'll email the primary contact on your tenant account at least 30 days before the change takes effect. You can object in writing before the change; if the objection cannot be resolved, you're entitled to terminate per the DPA.
Questions? Email [email protected] or see the DPA for the full commitment text.