Legal / Kraylo Subprocessor List
Kraylo Subprocessor List
Last updated: 10 September 2026
Kraylo uses the following core service providers to deliver the Services.
| Provider | Service | Typical data processed | Processing location | Status |
|---|---|---|---|---|
| Vercel | Web application hosting, edge delivery and deployment services | Website and application traffic, logs and limited technical data | Germany (EU) - Functions are configured in Frankfurt (fra1). Static assets are served through Vercel's global CDN. | Confirmed by Customer on 2 September 2026; configuration deployed |
| Supabase | Managed PostgreSQL, authentication, storage, realtime and backups | Customer operational data, account data, files, audit/security data | Germany (EU) - Customer-confirmed. Project primary data is stored in the selected region. | Confirmed by Customer |
| Stripe | Subscription billing and payment processing | Billing contacts, payment and transaction metadata | UK/EEA Stripe accounts contract with Stripe Payments Europe, Limited for the DPA, but Stripe's transfer terms provide for processing/transfers including to Stripe, LLC in the United States, using the Data Privacy Framework and/or UK IDTA/SCC safeguards where applicable. | Confirmed provider; global transfer position disclosed |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | Recipient name/email address, message content, delivery events and logs | Emails are routed and sent from Ireland (eu-west-1). Resend stores account data, message content and logs in the United States. UK/EU transfers are covered by its Data Privacy Framework certification (including the UK Extension) and its DPA/SCC transfer terms. | Confirmed by Customer on 2 September 2026; US transfer position disclosed |
| PostHog (PostHog, Inc.) | Product and website analytics | Usage and event data; page and feature interaction data; device/browser metadata; IP/network metadata where collected; user/account identifiers where configured; diagnostic event properties | EU region — PostHog Cloud EU stores customer event data in Germany (AWS eu-central-1, Frankfurt). The DPA contracting entity is PostHog, Inc. Restricted transfers, if any, are covered by PostHog's DPA and Standard Contractual Clauses. | Confirmed provider; EU-region configuration |
| Sentry (Functional Software, Inc. d/b/a Sentry) | Application error monitoring, diagnostics and performance monitoring | Application error data; stack traces; request/technical metadata; device/browser information; user/account identifiers where configured; diagnostic logs/context; IP/network metadata where collected | EU region — Sentry's EU data storage location is Frankfurt, Germany, with backups in the EU. The DPA contracting entity is Functional Software, Inc. d/b/a Sentry. Restricted transfers, if any, are covered by Sentry's DPA, Standard Contractual Clauses and Data Privacy Framework terms where applicable. | Confirmed provider; EU-region configuration |
Kraylo uses the service providers listed above to support delivery, analytics, diagnostics, security and operation of the Services.
Kraylo will give customers notice of intended material additions or replacements where required by the DPA, and will maintain equivalent data-protection obligations with its subprocessors.