Subprocessors
apublished
Version 1.0 Last updated: 8 August 2026
This page lists the third parties that process personal data on our behalf in order to provide the apublished Service. It forms part of the Data Processing Agreement and is the notice channel required by its Section 8.
Notice of changes. We give at least 30 days' notice before adding or replacing a subprocessor. To be notified, subscribe at apublished.com/subprocessors/subscribe or email legal@apublished.com asking to be added to the list. Customers may object on reasonable data protection grounds within the notice period, as set out in Section 8 of the DPA.
1. Infrastructure
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Fly.io, Inc. | Application and worker hosting, compute, and platform logs | All categories, in transit and in memory | United States | Paris, France (region cdg) | Standard Contractual Clauses |
| Fly.io, Inc. | Managed PostgreSQL: the primary datastore | All categories, at rest | United States | Paris, France (region cdg) | Standard Contractual Clauses |
| Cloudflare, Inc. | Object storage (R2) for media and derivatives; CDN; DNS; DDoS and bot protection; inbound email routing | Media files, derived images, technical logs, IP addresses, inbound email | United States | European Union (R2 jurisdiction: EU) | EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses |
2. Payments
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payment processing, subscription billing, invoicing, tax calculation, fraud prevention | Billing name, email, address, country, VAT number, card token, transaction records. Full card numbers are collected by Stripe directly and never reach apublished. | United States / Ireland | United States, Ireland | EU-US and Swiss-US Data Privacy Framework, and SCCs |
3. Communications
| Subprocessor | Purpose | Data processed | Entity location | Processing location | Transfer basis |
|---|---|---|---|---|---|
| Resend, Inc. | Transactional email: account notices, token expiry warnings, publication failures, security alerts. Delivered via Amazon SES. | Email address, name, message content | United States | European Union (Ireland) | Standard Contractual Clauses |
| Google Ireland Limited | Support correspondence. Inbound mail to our published addresses is routed by Cloudflare to a Google mailbox. | Email address, name, anything the customer writes to us | Ireland | European Union | Adequacy (EEA) |
4. Observability
None. We use no third-party error monitoring and no third-party log aggregation. Application logs stay on the hosting platform named in Section 1 and are not forwarded anywhere else.
5. Analytics
None. The apublished website and application load no analytics script, no session-recording tool and no advertising pixel. There is no consent banner because there is nothing to consent to. If that ever changes, this page and the privacy policy are updated at least 30 days beforehand, as Section 8 of the DPA requires.
6. Key management
No third party holds our keys. The master key that wraps every per-record data key, and the pepper used for API key hashing, are held as application secrets at the hosting provider named in Section 1. There is no separate key-management service in the arrangement, so there is no subprocessor to name here.
This is stated plainly because the opposite — "keys are held in a hardware security module operated by a third party" — is a common claim and would be false of us. What protects the key is the hosting provider's secret storage and our own access control, and nothing more.
Not subprocessors
The social media platforms. Facebook, Instagram, LinkedIn, Threads, TikTok and YouTube receive content because the customer instructs us to publish it to them. Each platform then acts as an independent controller of that content under its own terms with the account holder, not as our subprocessor. See the Platform Disclosures.
Our professional advisers. Our accountant and, where needed, our lawyer, act under professional duties of confidentiality rather than as subprocessors.
Change history
| Date | Change |
|---|---|
| 8 August 2026 | Initial publication |