Current subprocessors
| Company | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting of the website, console and API | All data in transit through the application | United States and global edge (Standard Contractual Clauses) |
| Supabase Inc. | Database and sign-in (authentication) | Account, organization and operational data | European Union |
| Amazon Web Services EMEA SARL | Key management (KMS) for the vault master key | Encryption keys only, no customer data | Ireland (eu-west-1) |
| Resend Inc. | Transactional email (sign-in, alerts, invoices, support answers) | Email address and message content | United States (Standard Contractual Clauses) |
| Telegram | The support team's desk for live chat conversations | Support messages and the email of the person writing | Outside the EEA (Standard Contractual Clauses) |
| Google LLC | “Continue with Google” sign-in, only if you choose it | Name, email and Google account identifier | United States (EU–US Data Privacy Framework) |
Other recipients that are not subprocessors
Blockchain networks and the public nodes and explorers we query receive public addresses and transactions, which are public by design; they receive no account data.
Market price providers (CoinGecko, Coinbase, Binance) receive no personal data.
Exchanges, risk-scoring (KYT) providers and Travel Rule counterparties that you connect or address yourself process data under your own agreement with them.
Changes
We announce a new subprocessor at least 30 days before it starts processing customer personal data, on this page and by email to account owners. A customer can object for reasonable data-protection reasons under the Data Processing Addendum.