Draft, not yet in force. This page is being reviewed and will apply once it is published with a date.
Sub-processors
Version 1.0 · Last updated [to fill: date, set when published]
Last changed: 3 November 2026
These companies process customer data on our behalf to run Paralleon CRM. Each is bound by a written agreement with data-protection terms at least as strict as our Data Processing Agreement. We give notice before adding or replacing one, and customers may object, as the DPA describes.
| Company | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting the app, file storage (backups, exports, uploaded logos), sending email | All customer data in transit; stored files; email addresses and messages we send | Global network; files stored in the Asia-Pacific region | Standard contractual clauses and the UK addendum; Cloudflare's DPA |
| Supabase, Inc. | The database | All customer records, synced mail and calendar, account data | Tokyo, Japan (AWS ap-northeast-1) | Standard contractual clauses and the UK addendum; Supabase's DPA |
| Anthropic, PBC | The AI features: summaries, drafts and the assistant | The text a feature needs: notes and activity, and mail only where an owner allows it | United States | Standard contractual clauses and the UK addendum; commercial terms forbid training on customer content |
| Razorpay Software Private Limited | Taking payments and issuing receipts | Billing contact, card or account details (held by Razorpay, not by us), amounts | India | A contract with security terms under India's DPDP Act; PCI DSS |
| Automattic Inc. (Gravatar) | Showing a person's photo | A SHA-256 hash of an email address, never the address | United States | Only a one-way hash leaves our servers; owners can turn photos off |
| Duck Duck Go, Inc. | Showing a company's logo | A company's web domain | United States | Only a domain leaves our servers; owners can turn logos off |
Your own providers
Google (Gmail and Google Calendar) and Microsoft (Microsoft 365 mail and calendar) are not our sub-processors. They are the customer's own providers: Paralleon CRM reads from and sends through them only when a person connects their own account, and only as the Privacy Policy describes.