> Subprocessors_
Our Subprocessors
Last updated: 1 September 2026
Customer data is stored and processed in the United Kingdom. The providers below process customer data on our behalf under our Data Processing Agreement. To receive notice of changes to this list, email hello@darkstrata.io.
| Subprocessor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| DigitalOcean, LLC | Application and database hosting | All Customer Data: user accounts, organisations, monitored assets, alerts, integrations, audit and billing records | United Kingdom (London) | UK hosted. Entity is US-based; UK International Data Transfer Addendum in the provider DPA |
| Amazon Web Services EMEA SARL | Data storage and processing | Monitored assets, exposure findings, service logs | United Kingdom (London) | UK hosted (eu-west-2); AWS Data Processing Addendum |
| Cloudflare, Inc. | Network delivery, security and backup | Request metadata in transit, contact-form submissions, encrypted backups | Global edge network; backups stored in Western Europe | Cloudflare DPA with EU SCCs and UK Addendum |
| Resend, Inc. | Email delivery | Recipient name and email address, alert and notification content, exposure report attachments | European Union (Ireland) | EU hosted; UK adequacy regulations for the EEA. Entity is US-based; Resend DPA with UK Addendum |
| Stripe Payments Europe, Ltd. | Payments and invoicing | Billing contact name and email, organisation name and address, payment card data (held by Stripe only) | European Union and United States | Stripe DPA with EU SCCs and UK Addendum |
| Functional Software, Inc. (Sentry) | Error monitoring | Error context, request URLs, organisation and user identifiers where present in an error | European Union (Germany) | EU hosted; UK adequacy regulations for the EEA. Entity is US-based; Sentry DPA with UK Addendum |
| Anthropic, PBC | AI summaries of exposure findings | Exposure details for monitored assets (affected logins, threat categories, malware family, dates). Not used for model training | United States | UK International Data Transfer Addendum |
| GitHub, Inc. | Software delivery | Transient administrative access during deployments. No Customer Data is retained | United States | UK International Data Transfer Addendum |
| Tailscale Inc. | Private networking | Network metadata only. Customer Data is end-to-end encrypted and not visible to the provider | Canada and United States | UK International Data Transfer Addendum |
Notes
- Integrations the Customer configures (webhooks, Slack, ticketing systems, directory providers) are not subprocessors. Data sent to them is sent on the Customer’s instruction to a recipient of the Customer’s choosing.
- Google Analytics is used on the public website only, with consent, and does not process Customer Data.
- Changes to this list are notified to Customers by email at least 30 days before a new subprocessor processes Customer Data.