Sub-processors

1. What this list covers

These are the companies that process personal data on our behalf to provide the hosted Scribase service, either personal data inside your projects (as described in the Data Processing Agreement) or personal data we hold about account holders (as described in the Privacy Policy). Each one is bound by a contract with data-protection terms no less protective than ours.

Sign-in with Google or GitHub is not on this list: when you choose it, that provider handles your sign-in under its own terms and sends us your email address and basic profile (such as your name).

2. Oracle Cloud Infrastructure

• Company: Oracle Corporation.
• Purpose: Servers, disks and networking that run the Service: the control API, the console back end and every project database, auth, storage, realtime and functions workload.
• Personal data: All Customer Data stored in projects, and account data.
• Location: Frankfurt, Germany (OCI region eu-frankfurt-1).

3. OCI Email Delivery

• Company: Oracle Corporation.
• Purpose: Sending our own transactional email: sign-in links, billing notices and service alerts.
• Personal data: Recipient email address and the content of the message.
• Location: Frankfurt, Germany (OCI region eu-frankfurt-1).

4. Cloudflare

• Company: Cloudflare, Inc..
• Purpose: DNS, TLS and proxying of traffic to the Service and to project endpoints, protection against abusive traffic, and hosting of the website, docs and console front end.
• Personal data: IP addresses, request metadata and the content of requests in transit.
• Location: Cloudflare global network; requests are handled at the location nearest the visitor.

5. Cloudflare R2

• Company: Cloudflare, Inc..
• Purpose: Encrypted off-site copies of backups, used only to restore the Service or a project.
• Personal data: Backup copies of Customer Data and account data.
• Location: Europe (bucket location: Eastern Europe).

6. Dodo Payments

• Company: Dodo Payments, as merchant of record.
• Purpose: Checkout, card payments, sales tax and VAT, invoices, refunds and subscription management.
• Personal data: Billing contact details, payment card details (entered on its checkout, never seen by us) and invoice history.
• Location: As described in the Dodo Payments privacy notice (dodopayments.com).

7. Changes to this list

Before a new sub-processor starts processing personal data in your projects, we update this page with a new effective date and give reasonable advance notice as set out in the Data Processing Agreement. Questions or objections go to support@scribase.com.