Subprocessors

Last updated: November 6, 2026

The following is a list of third-party subprocessors authorized to process personal data on behalf of CloudRepo (ChenPo LLC), plus Cloudflare (Turnstile), which also uses what its bot check receives to improve its own bot detection.

Subprocessor Purpose Data Processed Compliance
Amazon Web Services (AWS) Infrastructure, storage, compute All customer data and artifacts SOC 2, ISO 27001, FedRAMP
Braintree/PayPal Payment processing Billing information PCI DSS Level 1, SOC 2
GitHub Source code management Source code and operational tooling. Repository history retains billing records (customer names, email addresses, payment amounts) committed until October 2026; current billing records are kept outside the repository. The repository is private and its history is not rewritten. Customer organization identifiers appear in committed tooling. SOC 2, ISO 27001
Postmark Transactional email Email addresses, notification content SOC 2
Grafana Cloud Monitoring and observability System metrics and logs, including member email addresses and client IP addresses, kept for security and debugging SOC 2
PostHog Product analytics and error tracking Account information and email addresses (including those entered on signup forms before signup finishes), device, network, usage and error data, and session-recording data with credentials masked, used to run, support, debug and improve the service; on the website, also the name and website address of the company behind some earlier visits SOC 2
Intercom Customer support Support conversations, email SOC 2
Supabase Billing and operational systems Billing contacts, operational records SOC 2
Baserow (Cloud) Billing and operational systems Billing contacts, operational records SOC 2
Hookdeck Technologies Inc. Managed webhook gateway Organization ID and owner email address at signup SOC 2
Stripe Invoice-based payment processing Customer name and email address, invoice amounts and descriptions; card data is entered on Stripe's hosted page (not collected or stored by CloudRepo) PCI DSS Level 1, SOC 2
Google Workspace Founder email and business operations Copies of emails sent to customers (signup notices with organization ID, email address, IP address, user agent and referring page; welcome emails; receipts and payment reminders), customer replies and correspondence, server error alerts (the failing request with credentials removed, including the client IP address, and the error message), prospect correspondence ISO 27001, ISO 27017, ISO 27018, SOC 2, SOC 3
Intuit (QuickBooks Online) Accounting and bookkeeping Customer organization identifiers and company names, payment amounts and dates, plan line items, payment processor transaction references See Intuit Security
Apollo.io Website visitor identification Pages visited on the website and documentation (full address and referring site), campaign tags, IP address, browser details and a browser ID SOC 2, ISO 27001
Calendly Booking calls with the founder The details a visitor types into the booking calendar on our /meet page, such as name and email address; IP address and browser details when the calendar loads See Calendly Security
Cloudflare (Turnstile) Bot check on the signup page IP address, browser details (user agent and TLS fingerprint) and the site the check runs on, when the signup page loads the check; our servers also send Cloudflare the check token and the IP address to verify it See Cloudflare Compliance Resources

Changes to Subprocessors

CloudRepo updates this list before a new subprocessor starts processing personal data. To be notified of changes, email security@cloudrepo.io.

If you have concerns about a new subprocessor, please contact us at security@cloudrepo.io within 14 days of its addition to this list.

For more information about our security practices, visit our Trust Center.