Sub-Processors
Last updated:
VeloCMS uses the following third-party sub-processors to deliver its service. All sub-processors are bound by data processing agreements and appropriate safeguards under applicable data-protection law, including Article 28 GDPR where it applies.
VeloCMS’s company registration in Sharjah, United Arab Emirates is in progress. The registered company name, licence number and address will be published here once incorporation is complete.
We will notify tenants at least 30 days before adding or removing a sub-processor. To object to a new sub-processor, contact [email protected].
Stripe
Stripe, Inc. / Stripe Payments Europe, Ltd.
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Payment processing, subscription management, invoicing
- Data categories
- ·Name
- ·Payment card data
- ·Billing address
- ·Subscription status
Resend
Resend Inc.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Transactional email delivery (account notifications, export links, GDPR confirmations)
- Data categories
- ·Email address
- ·Email content
Cloudflare
Cloudflare, Inc.
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- CDN, DDoS protection, DNS, SSL/TLS certificates for custom tenant domains
- Data categories
- ·IP addresses (ephemeral)
- ·Domain names
- ·SSL certificate metadata
Railway
Railway Corp.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Cloud infrastructure — Next.js application server, PocketBase database hosting
- Data categories
- ·All data stored on the VeloCMS platform (infrastructure-level access only)
Sentry
Functional Software, Inc.
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- Error tracking and performance monitoring
- Data categories
- ·Error stack traces
- ·Browser/device type
- ·Page URLs
- ·User ID (anonymised)
Google Analytics
Google LLC / Google Ireland Limited
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Website analytics on velocms.org: cookieless pings before you choose, analytics cookies only after you accept
- Data categories
- ·Page address
- ·Referrer
- ·Language
- ·Screen size
- ·Browser type
- ·IP address (network request)
Microsoft Clarity
Microsoft Corporation
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Session analytics on velocms.org; loads only after you accept
- Data categories
- ·Clicks and scrolling
- ·How pages are displayed
- ·Browser and device type
- ·Page URLs
This list is maintained by VeloCMS and updated when sub-processors are added, removed, or materially changed. Tenants who have signed a Data Processing Agreement (DPA) with VeloCMS will be notified by email of any changes.
Questions? [email protected]