How to read this register
The brands below are supported by code or configuration evidence. That evidence does not by itself verify a production account’s contracting entity, enabled features, region, retention settings, or executed DPA. Those items must be checked before this register becomes the approved subprocessor schedule.
A provider’s own subprocessors are described in its legal materials. They are not automatically direct UserGist suppliers. AWS-compatible storage libraries do not establish that UserGist purchases AWS storage; the checked storage endpoint is Cloudflare R2. Supabase appears as an optional mobile identity integration and in demos, rather than an established core UserGist provider.
Infrastructure that can process customer data
| Provider | Service and information | Location evidence / verification needed |
|---|---|---|
| DigitalOcean | Application hosting and configured PostgreSQL; potentially customer profiles, responses, portal/support content, audit records, and service metadata. Confirm the hosts of Redis, queues, and any legacy ClickHouse. | Portal deployment spec selects Frankfurt. Checked local PostgreSQL hostname indicates NYC3, United States. Verify each production component, database, replica, backup, and support-access location. |
| Tinybird | Configured analytics storage/querying: events, supplied properties, feedback/survey analytics, reachability and push-delivery records. | Checked local API endpoint is the GCP europe-west2 region, London, United Kingdom. Verify production workspace, retention, legal entity, and onward processing. |
| Cloudflare | R2 object storage for private exports and public campaign/portal assets; public website edge/network protection, including bot-management cookies. | R2 S3 region is “auto”; this does not prove an EU jurisdiction restriction. Live public responses also show Cloudflare and a __cf_bm cookie. Confirm bucket jurisdiction, lifecycles, edge settings, and support processing. |
| Resend | SMTP delivery for portal verification, invitations, support notifications, and service/billing messages. Receives recipients and relevant message content. | Checked SMTP host is Resend. Confirm contracted entity, message/log retention, delivery infrastructure, and processing locations. |
| Sentry | Optional server error reporting: exception details and diagnostic context, which may include identifiers or customer text in error context. | A DSN is configured locally. Confirm production enablement, selected region, scrubbing, access, retention, and vendor agreement. |
Account, billing, and optional usage services
| Provider | Role and information | Verification needed |
|---|---|---|
| WorkOS | Dashboard authentication, users, invitations/session identity, and MCP authorisation. Account/profile and authentication records; not the full SDK event stream by default. | Read-only Production and Staging checks found no hosted legal links configured. Apply approved links after publication; also confirm legal entity, region/support access, retention, and accepted DPA. |
| Paddle | Merchant-of-record checkout and billing, customer/subscription/transaction identifiers, contact details, and purchase information. May act as independent controller for its own legal obligations. | Checked local billing is sandbox. Confirm live seller entity, checkout buyer terms, taxes, refund/cancellation treatment, and production setup. |
| Amplitude | Optional dashboard product analytics after opt-in: manual product events and limited identifiers. Session replay and automatic click/form capture are disabled in this release. | Confirm production project, data region, retention and deletion, DPA, and migration/erasure of previously collected replay data. |
| Google Fonts | The existing dashboard requests a font stylesheet/font files for SDK previews from Google’s font services. This exposes ordinary request metadata, such as IP and browser details, to that service. | Other next/font fonts are bundled by the build. Review this separate runtime stylesheet request and preferably self-host the preview font before approving the notice. |
Services selected or supplied by customers
- Apple Push Notification service and Google Firebase Cloud Messaging handle enabled mobile push tokens and notification payloads using customer-supplied platform credentials. The exact contractual role follows the enabled service and the parties’ arrangement.
- Customer-configured Amplitude and Mixpanel destinations receive supported structured events when enabled. These are distinct from UserGist’s own dashboard analytics; customers select the destination, project, and region.
- An external AI client connected to MCP can receive authorised tool results, including customer content. The customer chooses and governs that client/provider. A connection does not automatically authorise all apps or actions.
- An optional Supabase mobile-auth exchange verifies an integration’s token when configured. Do not assume this means every UserGist customer uses Supabase or that all app data is stored there.
Changes and objections
The DPA proposes advance written notice and an opportunity to object to new or replacement subprocessors. UserGist must establish the notification channel and designated recipients before offering a fixed notice commitment. To request the current approved register or discuss a provider, use the contact below.
Contact [email protected] with the subject “Privacy request” or “Legal request”, as appropriate. Do not send passwords, API keys, payment card numbers, or identity documents in an initial message.
You can save or print this document using your browser’s print menu. Keep the version and draft status with any copy.