apublished

Subprocessors

apublished

Version 1.0 Last updated: 8 August 2026


This page lists the third parties that process personal data on our behalf in order to provide the apublished Service. It forms part of the Data Processing Agreement and is the notice channel required by its Section 8.

Notice of changes. We give at least 30 days' notice before adding or replacing a subprocessor. To be notified, subscribe at apublished.com/subprocessors/subscribe or email legal@apublished.com asking to be added to the list. Customers may object on reasonable data protection grounds within the notice period, as set out in Section 8 of the DPA.


1. Infrastructure

SubprocessorPurposeData processedEntity locationProcessing locationTransfer basis
Fly.io, Inc.Application and worker hosting, compute, and platform logsAll categories, in transit and in memoryUnited StatesParis, France (region cdg)Standard Contractual Clauses
Fly.io, Inc.Managed PostgreSQL: the primary datastoreAll categories, at restUnited StatesParis, France (region cdg)Standard Contractual Clauses
Cloudflare, Inc.Object storage (R2) for media and derivatives; CDN; DNS; DDoS and bot protection; inbound email routingMedia files, derived images, technical logs, IP addresses, inbound emailUnited StatesEuropean Union (R2 jurisdiction: EU)EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses

2. Payments

SubprocessorPurposeData processedEntity locationProcessing locationTransfer basis
Stripe, Inc. and Stripe Payments Europe, Ltd.Payment processing, subscription billing, invoicing, tax calculation, fraud preventionBilling name, email, address, country, VAT number, card token, transaction records. Full card numbers are collected by Stripe directly and never reach apublished.United States / IrelandUnited States, IrelandEU-US and Swiss-US Data Privacy Framework, and SCCs

3. Communications

SubprocessorPurposeData processedEntity locationProcessing locationTransfer basis
Resend, Inc.Transactional email: account notices, token expiry warnings, publication failures, security alerts. Delivered via Amazon SES.Email address, name, message contentUnited StatesEuropean Union (Ireland)Standard Contractual Clauses
Google Ireland LimitedSupport correspondence. Inbound mail to our published addresses is routed by Cloudflare to a Google mailbox.Email address, name, anything the customer writes to usIrelandEuropean UnionAdequacy (EEA)

4. Observability

None. We use no third-party error monitoring and no third-party log aggregation. Application logs stay on the hosting platform named in Section 1 and are not forwarded anywhere else.

5. Analytics

None. The apublished website and application load no analytics script, no session-recording tool and no advertising pixel. There is no consent banner because there is nothing to consent to. If that ever changes, this page and the privacy policy are updated at least 30 days beforehand, as Section 8 of the DPA requires.

6. Key management

No third party holds our keys. The master key that wraps every per-record data key, and the pepper used for API key hashing, are held as application secrets at the hosting provider named in Section 1. There is no separate key-management service in the arrangement, so there is no subprocessor to name here.

This is stated plainly because the opposite — "keys are held in a hardware security module operated by a third party" — is a common claim and would be false of us. What protects the key is the hosting provider's secret storage and our own access control, and nothing more.


Not subprocessors

The social media platforms. Facebook, Instagram, LinkedIn, Threads, TikTok and YouTube receive content because the customer instructs us to publish it to them. Each platform then acts as an independent controller of that content under its own terms with the account holder, not as our subprocessor. See the Platform Disclosures.

Our professional advisers. Our accountant and, where needed, our lawyer, act under professional duties of confidentiality rather than as subprocessors.


Change history

DateChange
8 August 2026Initial publication