Sub-processors
Version 1.0, last updated July 18, 2026
easyboard uses a small set of trusted third-party providers ("sub-processors") to run the service. When easyboard acts as a data processorfor a customer's board data, these providers may process personal data on our behalf, under the terms of our Data Processing Agreement. Each is bound by a data processing agreement with appropriate safeguards for international transfers.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Google Cloud (Cloud Run) | Application hosting and compute | United States (us-east1) | EU Standard Contractual Clauses |
| Supabase | Database and file storage (candidate profiles, CVs, applications) | European Union (West Europe, London) | Stored in the EEA; SCCs cover vendor support access |
| WorkOS | Authentication, single sign-on and directory sync | United States | EU SCCs + EU-US Data Privacy Framework |
| Stripe | Payments and billing | United States / global | EU SCCs + UK IDTA + EU-US Data Privacy Framework |
| Postmark (ActiveCampaign) | Transactional and notification email | United States | EU Standard Contractual Clauses |
| Inngest | Background jobs, scheduling and event delivery | United States | EU Standard Contractual Clauses |
| Cloudflare | CDN, DNS, and bot protection (Turnstile) | Global edge network | EU SCCs (EU Data Localization available) |
| Approximated | Custom-domain routing and SSL (only for boards on a custom domain) | United States | EU Standard Contractual Clauses |
| Sentry | Error monitoring and diagnostics | United States | EU SCCs + EU-US Data Privacy Framework |
Where your data is stored
Candidate and employer personal data (profiles, CVs, applications) is stored in the European Union (Supabase, West Europe). Application compute currently runs in the United States (Google Cloud Run), and several providers above are US-based; transfers outside the EEA are covered by the Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework.
Changes to this list
We will update this page before a new sub-processor begins processing customer personal data, and we aim to give at least 30 days' notice of a material change. Customers on a plan that includes it can object to a new sub-processor as set out in the DPA. To be notified of changes, contact support@easyboard.co.