Subprocessors
Last revised 5 October 2026. In effect from 22 September 2026.
A subprocessor is a company MarshalCloud, a product of DEVINSEC PVT. LTD, uses to run the service that may process customer data along the way. This page is referenced by the data processing addendum and forms part of it. Each subprocessor is engaged under its own standard terms; its contracting entity and the countries where it processes data are set by those terms and are not restated here. Where MarshalCloud’s own code or infrastructure code fixes the region data is sent to, the table says so; otherwise the vendor’s terms govern.
Engaged for every organization
| Subprocessor | What it is used for | What it receives | When |
|---|---|---|---|
| Amazon Web Services | Hosting for everything MarshalCloud runs, in the Asia Pacific (Mumbai) region: the application and its hosted build runners, the primary database, the cache, the analytics store that holds billing, Kubernetes usage and uptime results, file storage for build artifacts and setup templates, and encryption keys. | All customer data held by the service, in transit and at rest, in the Mumbai region. MarshalCloud’s own software images, which hold no customer data, are also copied to AWS’s US West (Oregon) region. | Always. |
| Cloudflare | DNS for MarshalCloud’s domain, and hosting the public marketing site (marshalcloud.com). | For the marketing site: the visitor’s IP address, the address requested, and the browser’s headers. The application’s address (app.marshalcloud.com) is a DNS-only record, so requests to the application go straight to AWS and do not pass through Cloudflare. | Always. |
| Resend | Sending MarshalCloud’s email: alerts, reports, invitations, verification and password reset links, billing and account notices, and contact form acknowledgements. | Recipient email address, subject, and message body, which can include a monitored address, an error message, a computer’s name and its reported issue, or spend figures. From Resend’s delivery reports, MarshalCloud records only whether a message was delivered, bounced, or marked as spam. | Whenever the service sends an email. |
| Anthropic | The interactive AI assistant that answers questions about an organization’s own data. | The question and conversation history, plus the data the assistant reads to answer: costs and recommendations, resources, monitors, incidents, security findings, change records, infrastructure plans, and earlier AI answers. Email addresses, phone numbers, IP addresses, AWS resource names, account IDs, and access key IDs are replaced with pseudonyms first, including in advice an operator leaves during a run. Never cloud credentials or device telemetry. | When someone uses the assistant, unless the organization has connected its own AI provider. |
| OpenAI | Incident summaries, postmortem and questionnaire drafts, infrastructure plan reviews, fix plans, weekly briefings, the embeddings behind search over an organization’s own records, and a fallback for the assistant when Anthropic is unavailable. | The same categories as Anthropic, limited to what each feature needs, with the same pseudonyms applied. For questionnaire drafts, also passages from policy documents the organization added. | When one of those features runs, unless the organization has connected its own AI provider. |
| Titan (titan.email) | The mailbox provider behind MarshalCloud’s own inboxes, including hello@marshalcloud.com. The domain’s inbound mail records point at Titan. | Every email sent to a marshalcloud.com address: privacy requests, legal notices, security reports, and the contact form submissions the service forwards to its team (name, email, company, message). | Whenever someone writes to MarshalCloud or submits the contact form. |
| Sentry | Error reporting for our own software: telling our team when the service itself fails, and how long requests take. | When our software fails or logs a warning: the error type and message, the stack trace (the files, functions and lines of our own code involved), the software version, the path and method of the request being served, the browser’s user agent, a request ID, and the host names (never the full addresses) of requests the service made just before. For about one request in ten, a timing trace: the path, how long each step took, and database query text without its values. Before anything is sent, email addresses, access keys, tokens, passwords, cloud account IDs and resource names (ARNs) are removed from the text. Request bodies, cookies, query strings, sign-in and API key headers, IP addresses, who was signed in, and the values of variables are never sent. | Whenever our software records an error or a warning, and on a sample of requests.In use since 5 October 2026. |
| Supabase | Storing the product feedback people send from inside the service, so our team can read and sort it. | What the person wrote and its type (bug, idea or question); the page it was sent from (the address without its query string, and the page title); the browser’s user agent and screen size; the last 50 lines of the page’s own log and the addresses (without query strings) and status codes of its recent requests, with tokens, keys, passwords, cloud account IDs and resource names removed first; a screenshot only if the person adds one, after they have had the chance to hide parts of it; and who sent it: their user ID, email address and role, and their organization’s ID, name, workspace address and the product name the workspace shows. | Only when someone sends product feedback.In use since October 2026, for product feedback only. |
Engaged only when an organization uses the feature
| Subprocessor | What it is used for | What it receives | When |
|---|---|---|---|
| Stripe | Taking payment for paid plans and holding the subscription. | The organization’s name, the buying owner’s email address, and the organization’s MarshalCloud ID, sent by MarshalCloud when checkout starts; and the billing and card details the buyer types on Stripe’s own pages, which never reach MarshalCloud. MarshalCloud stores the Stripe customer and subscription identifiers. | Only when an owner starts checkout for a paid plan. |
| Slack | Delivering alerts and approval requests into a Slack channel, and receiving approvals clicked in Slack. | Outbound: alert titles and bodies, and the approval message for a proposed change. Inbound: the Slack workspace ID, user ID, and username of the person who clicked. | Only if the organization adds a Slack channel or connects Slack approvals. |
| Google Cloud | MarshalCloud’s own Google Cloud service account, which a customer grants access to read billing exports, inventory, recommendations, and security findings in the customer’s Google Cloud project. | The requests MarshalCloud makes into the customer’s project, and the results. MarshalCloud stores the project and table identifiers for the connection. | Only if the organization connects a Google Cloud account. |
Your own accounts, which are not our subprocessors
When you connect one of your own accounts, MarshalCloud acts inside it on your instruction, and your agreement with that provider applies:
- Cloud providers you connect: AWS, Google Cloud (the project itself), Azure, DigitalOcean, Linode, Hetzner, Hostinger, and Cloudflare.
- Monitoring and error tools you connect: Datadog, Sentry, and New Relic. MarshalCloud reads from them and sends them nothing.
- GitHub, when you install our GitHub App or connect a token: MarshalCloud reads your repository and security alerts, and writes branches and pull requests into your repository. GitHub stays your own account under your agreement with GitHub; it is not a MarshalCloud subprocessor.
- An AI provider you connect with your own key or endpoint (Anthropic, OpenAI, OpenRouter, or another OpenAI-compatible service). OpenRouter forwards requests to the model provider it routes them to.
- Webhook addresses you add, which receive alert text.
Public data sources
These are public services MarshalCloud looks things up in. They are not sent customer personal data: domain registry lookup services (RDAP) receive the domain names of your domain expiry monitors, and FIRST’s exploit prediction service receives vulnerability identifiers (CVE numbers).
Changes to this list
A new subprocessor is added to this list before it starts, with the date it started. Where customer personal data is subject to the EU GDPR or the UK GDPR, MarshalCloud also gives at least 30 days’ notice by email to the organization’s owners first, and they may object on reasonable data protection grounds, as set out in section 9 of the data processing addendum.