1. Local-only operation
Running a local Runstamp package without a hosted endpoint does not send document inputs or outputs to these providers. The table applies only to public sites and enabled hosted/account/support functions. Not every provider receives every data category.
2. Active providers
| Provider | Purpose | Typical data | Typical location |
|---|---|---|---|
| Vercel Inc. | Website, account, API, serverless/edge and hosted-feature delivery | Account data, requests, logs, Customer Personal Data submitted to hosted features | United States and global edge |
| Supabase Pte. Ltd. | Database, authentication, storage, account/license/entitlement records | Account/license data, hosted Customer Content, operational records | United States |
| Cloudflare, Inc. | DNS for runstamp.com | DNS queries (resolver IP address) | Global network |
| Upstash, Inc. (Redis) | Rate limits, cache and billing-webhook replay protection | Pseudonymous identifiers, counters, cache payloads and webhook identifiers | Configured U.S. or EU provider region |
| Plus Five Five, Inc. (Resend) | Transactional account/license/support email | Names, emails, organization, message/delivery metadata | United States |
| PostHog, Inc. | Product analytics where enabled | Pseudonymous usage/feature events, device data, and sanitized diagnostics | United States |
| Mintlify, Inc. | Hosting Runstamp's public documentation | Documentation requests, IP/device logs, public-doc analytics | United States and provider infrastructure locations |
| Better Stack, Inc. | Uptime monitoring, public status page, incident/status subscriptions | Endpoint results, operational metadata, status visitor data, subscriber email | United States and provider infrastructure locations |
Runstamp does not currently list OpenAI, Google Gemini, or Anthropic as an active hosted Customer Content subprocessor. Customer-selected AI use is outside this table. We will update this page before activating a Runstamp-managed AI provider.
3. Independent controllers and public platforms
| Provider | Purpose | Role |
|---|---|---|
| Paddle.com Market Limited and affiliates | Merchant of record, checkout, payment, subscription, tax, invoice, fraud, chargeback, refund | Independent controller for transaction data |
| GitHub, Inc. | Public repositories, issues, pull requests, releases, Actions | Independent platform under GitHub terms |
| npm, Inc. / GitHub | Public package registry and downloads | Independent platform under registry terms |
Customer-controlled CI/CD, repositories, registries, storage, connectors, webhooks, workspaces, and AI providers are selected and administered by Customer and are not automatically our subprocessors.
4. Notice and objections
We provide at least 30 days' notice before a new/replacement subprocessor materially handles Customer Personal Data, except urgent security, legal, availability, or continuity needs may shorten notice. DPA customers may object on reasonable data-protection grounds within 14 days; the DPA governs resolution.
5. Change log
| Date | Change |
|---|---|
| October 11, 2026 | Corrected provider legal entity names: Supabase Pte. Ltd. and Plus Five Five, Inc. (operating as Resend), as named in those providers' own terms and data processing addenda. Cloudflare limited to DNS: the website, account and API, hosted-feature queues and scheduled jobs run on Vercel and Supabase (webhook and execution queues use the Supabase database). Removed Channel.io: support is by email. |
| October 1, 2026 | Consolidated analytics and diagnostics in PostHog; removed obsolete providers. |
| August 25, 2026 | Added Mintlify and Better Stack; clarified local-only and AI-provider boundaries; consolidated Upstash services. |
Questions/notices: hello@runstamp.com