Sub-processors
Last updated: November 11, 2026
These are the third-party providers that may process personal data for Plutonapps and for our customers' products we run. We update this list before adding or replacing a provider.
Current sub-processors
| Provider | What they do | Where |
|---|---|---|
| Clerk, Inc. | Sign-in and account identity: name, email address, Google profile (if you use Google sign-in), profile picture, session records | United States |
| Supabase, Inc. | Database and file storage for accounts, requests, messages, attachments, intake answers, bookings, inquiries and billing status | United States (AWS us-east-1, North Virginia) |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices and the billing portal. Card details are entered on Stripe and never reach our servers | United States and Ireland |
| Resend (Plus Five Five, Inc.) | Sending transactional email: sign-in-adjacent notices, chat and inquiry notifications, staff invitations | United States |
| DigitalOcean, LLC | Hosting the website and application servers, including server logs | United States (NYC1) |
| Cloudflare, Inc. | DNS, network security and content delivery in front of the site; relaying voice for SOS calls (encrypted end to end) | Global network |
| Google LLC | Google Calendar and Google Meet for booked calls, if you or our staff connect a Google Calendar: the connected Google account's email, the call's time, title and attendees, and busy times; STUN (address discovery) for SOS voice calls | United States |
| GitHub, Inc. | Source code hosting and build pipelines. No customer personal data is stored there by design | United States |
| 650 Industries, Inc. (Expo) | Delivering the Plutonapps mobile app's push notifications: the device's push token and the notification's title and text, passed to Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) for delivery | United States |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Delivering the browser notifications you turn on: the push subscription address and the notification, encrypted so the service cannot read it | Their own networks, mainly in the United States |
Stripe also acts as an independent controller for payment processing. Google Search Console only measures the website's own search visibility and receives no visitor or customer personal data. PageSpeed Insights measures our own site, and the app address you scan with the readiness check's live scan; Google's other services are listed above.
Where your product runs on infrastructure you own, those providers are yours, not ours, and are not listed here.
Updates
We email every customer 30 days before a change; others can ask to be added by emailing hello@plutonapps.com.