Sub-processors

Last updated 17 August 2026.

A sub-processor is a company we use to run demobolt that may handle personal data on our behalf. This page is the current list. It forms part of our Data Processing Agreement, and the notice period below is a contractual commitment, not a courtesy.

Every company here is bound by a written contract that lets it use the data only to provide its service to us. We stay responsible to you for what they do.

Who we use

Each entry reads: what they do for us, where they are, and what covers the transfer of any personal data reaching them.

• Vercel — Hosting for the marketing site and the web app. United States. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Railway — Hosting for the API that stores and serves demos. United States. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Supabase — Database, sign-in, and file storage for captures and assets. United States. Standard Contractual Clauses.
• Cloudflare — Content delivery, DNS, and protection against attacks. United States and global edge network. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Polar — Payments and invoicing, as seller of record. United States. Standard Contractual Clauses.
• PostHog — Product analytics for the app, when you allow it. United States. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Sentry — Error monitoring, so we are told when something breaks. United States. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Inngest — Running background jobs, such as publishing and clean-up. United States. Standard Contractual Clauses.
• Loops — Account and product email. United States. EU-US Data Privacy Framework (plus UK and Swiss extensions).
• Crisp — Live chat support. France, with data stored in the Netherlands and Germany. None needed — the data stays in the EU.

How transfers are covered

demobolt runs in the United States. Where a provider is certified under the EU-US Data Privacy Framework, that certification covers personal data reaching them from the EU, UK and Switzerland. Where a provider is not certified, the EU Standard Contractual Clauses apply instead, with the UK Addendum and the Swiss adaptations where relevant.

demobolt itself is not certified under the Data Privacy Framework, so the Standard Contractual Clauses in our Data Processing Agreement cover the transfer from you to us. Ask us at hello@demobolt.io if you need a copy of the clauses.

Changes to this list

We give at least 10 days’ notice before a new or replacement sub-processor starts handling your data. We update this page and email the address on your account.

If we have to replace one urgently — a security problem, an outage, or a provider that stops serving us — we may act immediately and tell you as soon as we reasonably can. Your right to object is unchanged.

If you object on reasonable data protection grounds within that period, write to hello@demobolt.io and we will work with you to find a solution. If we cannot, you may cancel your subscription and you keep access until the end of the period you have already paid for.