Subprocessors
apublished
Version 1.0 Last updated: 4 October 2026
This page lists the third parties that process personal data on our behalf in order to provide the apublished Service. It forms part of the Data Processing Agreement and is the notice channel required by its Section 8.
Notice of changes. We give at least 30 days' notice before adding or replacing a subprocessor. To be notified, subscribe at apublished.com/subprocessors/subscribe or email legal@apublished.com asking to be added to the list. Customers may object on reasonable data protection grounds within the notice period, as set out in Section 8 of the DPA.
1. Infrastructure
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Fly.io, Inc. | Application and worker hosting, compute, and platform logs | All categories, in transit and in memory | United States | Paris, France (region cdg) | Standard Contractual Clauses |
| Fly.io, Inc. | Managed PostgreSQL: the primary datastore | All categories, at rest | United States | Paris, France (region cdg) | Standard Contractual Clauses |
| Cloudflare, Inc. | Object storage (R2) for media and derivatives; CDN; DNS; DDoS and bot protection; inbound email routing | Media files, derived images, technical logs, IP addresses, inbound email | United States | European Union (R2 jurisdiction: EU) | EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses |
| Cloudflare, Inc. | Speech-to-text transcription of uploaded video and audio (Workers AI) | The audio track of uploaded files, and the transcript returned | United States | Cloudflare's global network; no region commitment | EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses |
2. Payments
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payment processing, subscription billing, invoicing, tax calculation, fraud prevention | Billing name, email, address, country, VAT number, card token, transaction records. Full card numbers are collected by Stripe directly and never reach apublished. | United States / Ireland | United States, Ireland | EU-US and Swiss-US Data Privacy Framework, and SCCs |
3. Communications
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Resend, Inc. | Transactional email: account notices, token expiry warnings, publication failures, security alerts. Delivered via Amazon SES. | Email address, name, message content | United States | European Union (Ireland) | Standard Contractual Clauses |
| Google Ireland Limited | Support correspondence. Inbound mail to our published addresses is routed by Cloudflare to a Google mailbox. | Email address, name, anything the customer writes to us | Ireland | European Union | Adequacy (EEA) |
4. Observability
None. We use no third-party error monitoring and no third-party log aggregation. Application logs stay on the hosting platform named in Section 1 and are not forwarded anywhere else.
5. Analytics
| Provider | What it receives | Where |
|---|---|---|
| Google Analytics (Google Ireland Ltd) | Page views on the public pages (address without its query string, referring site, language), and the events sign-up, sign-in, checkout started and payment (plan and amount). | Collected at Google's EU endpoint; Google may process in the United States. |
How. Our server sends these events to Google itself. The website still loads no analytics script and sets no analytics cookie, so there is no consent banner. A visitor is identified only by a code made from their IP address, browser and a random value that changes every day and is never stored; the IP address itself is not sent to Google, and the code cannot be linked across days. No session recording and no advertising pixel.
Added 4 October 2026. Under Section 8 of the DPA, this addition takes effect 30 days after that date.
6. Key management
No third party holds our keys. The master key that wraps every per-record data key, and the pepper used for API key hashing, are held as application secrets at the hosting provider named in Section 1. There is no separate key-management service in the arrangement, so there is no subprocessor to name here.
This is stated plainly because the opposite — "keys are held in a hardware security module operated by a third party" — is a common claim and would be false of us. What protects the key is the hosting provider's secret storage and our own access control, and nothing more.
Not subprocessors
The social media platforms. Facebook, Instagram, LinkedIn, Threads, TikTok and YouTube receive content because the customer instructs us to publish it to them. Each platform then acts as an independent controller of that content under its own terms with the account holder, not as our subprocessor. See the Platform Disclosures.
Our professional advisers. Our accountant and, where needed, our lawyer, act under professional duties of confidentiality rather than as subprocessors.
Change history
| Date | Change |
|---|---|
| 8 August 2026 | Initial publication |