Legal
Subprocessors
Updated 11 October 2026
These are the service providers that process personal data for Scopebond, as subprocessors of your workspace's data or as processors of the account, billing and website data Avouro LLC is responsible for. Each one works under a written agreement that requires it to protect the data and use it only to provide its service to us. The Privacy Policy says what we collect and why, and the Data Processing Agreement sets the terms for your workspace's data. Sign-in providers you choose (Google, Microsoft, GitHub or your company's single sign-on) are not listed: you sign in with them directly, under their own terms.
Changes and notice
We give at least 30 days' notice before a new subprocessor starts processing workspace data, here and by email to everyone who subscribes below. A workspace owner can object under the Data Processing Agreement. Every change is recorded in the change log at the end of this page.
United States region
A workspace in the United States region keeps its agents, computers, rules, evidence and backups in the United States.
| Provider | What it does | Data it processes | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, databases, evidence storage, backups and logs; Turnstile checks that a sign-in comes from a person | All workspace and account data; IP address and browser signals for Turnstile | United States; requests are handled at the nearest Cloudflare data centre |
| Stripe, Inc. | Payments, invoices and tax | Payer name, email, billing address, tax ID and payment method | United States |
| Resend, Inc. | Email: sign-in, invitations, alerts, monthly reports and plan notices; the waitlist and this page's change notices | Names, email addresses and message content (alerts can name agents, computers, people and workspaces) | United States |
| PostHog, Inc. | Product analytics, sent through Scopebond's own address | Page and event names; no cookies, and the IP address is discarded | United States; moving to the European Union (Frankfurt) |
| Functional Software, Inc. (Sentry) | Error reports from the service and the workspace | Error messages, stack traces and the request path, scrubbed of email addresses, home folders and tokens; the IP address is not stored | European Union (Germany) |
| Google LLC | Workspace mail for support and security messages | Whatever you write to us | United States and Google's data centres |
| Google LLC (Firebase Authentication and reCAPTCHA) | Mobile-number verification and texted sign-in codes, only when a person asks for a code | Mobile number, IP address and browser signals; the Firebase sign-in record is deleted right after the check | United States |
| GitHub, Inc. | GitHub Actions: builds and the monthly restore drill, which restores an encrypted backup on a runner to prove it works | Backups of the United States databases during the drill | United States |
| Microsoft Corporation (Azure) | Runs the restore drill for European Union region backups only | No workspace data of this region | European Union |
| Better Stack, Inc. | Uptime checks of our public addresses and the status page | No workspace data: the checks read public health endpoints | United States and other countries |
European Union region
The European Union region opens soon in production. A workspace in it keeps its agents, computers, rules, evidence and backups in the European Union. Sign-in, workspace membership and the billing link are held centrally in the United States for every workspace, protected by the EU Standard Contractual Clauses.
| Provider | What it does | Data it processes | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, databases, evidence storage, backups and logs; Turnstile checks that a sign-in comes from a person | All workspace data; IP address and browser signals for Turnstile | European Union for the workspace's databases, evidence, backups and record intake; requests are handled at the nearest Cloudflare data centre |
| Stripe, Inc. | Payments, invoices and tax | Payer name, email, billing address, tax ID and payment method | United States |
| Resend, Inc. | Email for the workspace: invitations, alerts, monthly reports and plan notices; sign-in email is sent from the United States | Names, email addresses and message content | European Union (Ireland) for workspace email |
| PostHog, Inc. | Product analytics, sent through Scopebond's own address | Page and event names; no cookies, and the IP address is discarded | United States; moving to the European Union (Frankfurt) |
| Functional Software, Inc. (Sentry) | Error reports from the service and the workspace | Error messages, stack traces and the request path, scrubbed; the IP address is not stored | European Union (Germany) |
| Google LLC | Workspace mail for support and security messages | Whatever you write to us | United States and Google's data centres |
| Google LLC (Firebase Authentication and reCAPTCHA) | Mobile-number verification and texted sign-in codes, only when a person asks for a code | Mobile number, IP address and browser signals; the Firebase sign-in record is deleted right after the check | United States |
| GitHub, Inc. | GitHub Actions: builds. The European Union backups are not restored on GitHub. | No workspace data of this region | United States |
| Microsoft Corporation (Azure) | The monthly restore drill: a container restores an encrypted backup into a scratch database to prove it works, then is deleted | Backups of the European Union databases during the drill | European Union (Sweden; Germany as fallback) |
| Better Stack, Inc. | Uptime checks of our public addresses and the status page | No workspace data: the checks read public health endpoints | United States and other countries |
Announced, not used today
- Anthropic, PBC: AI explanations of records, if they launch. Not used today. It will be added to the tables above only after 30 days' notice, and not for European Union workspaces until processing in the EU is available.
Transfers
Where a provider processes data from the European Economic Area, the United Kingdom or Switzerland outside them, the transfer is covered by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments in that provider's agreement, and by the EU–US Data Privacy Framework where the provider is certified.
Be told about changes
Get an email when this list changes, at least 30 days before a new subprocessor starts processing workspace data. We use your address only for these notices, and every email has an unsubscribe link.
Change log
- 11 October 2026. First published list. Product analytics (PostHog) now goes through Scopebond's own address with no cookies and no IP address, error reports (Sentry) are processed in Germany, Google Firebase and reCAPTCHA are used for mobile-number verification, Microsoft Azure runs the European Union backup restore drill, and Cloudflare Web Analytics is no longer used.