Subprocessors · RedlinerHQ

1 Our subprocessors

Subprocessor	What it does for us	Data involved	Location
Microsoft AzureMicrosoft Corporation	Runs our API (App Service). Stores the activity log, sessions, suspensions and Customer settings (Table Storage). Holds secrets (Key Vault). Sends email: alerts and digests to Customers' admins, and portal support and contact form messages to our mailbox (Communication Services). Keeps operational logs (Azure Monitor). Our own identity: the app registration Customers grant access to, and our staff's sign-in (Microsoft Entra ID).	Everything we store (see DPA Annex 1). PDFs and markup pass through our API in memory. Audio conversion also uses private temporary output files, deleted after processing; review copies go to Customer Storage. Names and email addresses appear in the emails it sends.	The Azure region of our deployment: Central US (Iowa, United States) unless an Order says otherwise. Email: United States.
CloudflareCloudflare, Inc.	DNS, content delivery and a protective proxy for our domains. Hosts the portal's web app and this website (Pages).	IP addresses and request details for our website and web app. Where an API hostname uses Cloudflare's proxy, API traffic, including PDFs, is handled by Cloudflare between encrypted browser and origin connections. Audio is configured to stream directly from the API rather than through the Cloudflare proxy. Staging API requests also use a direct Azure hostname. API responses are configured not to be cached. Cloudflare retains operational or security records under its service policies; it is not our content archive.	Global network
StripeStripe, Inc.	Invoices and automatic payments by card or US bank account (ACH), on Stripe's hosted pages.	Customers' billing contacts, company details, invoices and payment details. No Document content or Markup. Stripe may also act as an independent controller for payment, fraud-prevention and legal duties under its own privacy policy.	United States
Google CloudGoogle LLC	Holds our service account, which Customers on Google shared drives add to their drives so the portal can read documents and write markup. Holds our OAuth client for Google sign-in, and publishes the keys we check Google sign-in tokens against.	Our service account's credentials and tokens, and records of its requests. The documents themselves are served from the Customer's Google Workspace. Google sign-in and Admin storage-selection tools involve Google processing authentication and request details. Token signature checks use Google's published keys.	Global (Google's infrastructure)
Microsoft 365Microsoft Corporation	Handles our support email, where portal support, application and contact form messages arrive. Our domain's mail routing uses Microsoft 365.	What a person sends us: their name, email address, the Customer's name, their message, and browser details only if they ticked the box.	Microsoft 365 infrastructure. Mailbox data location depends on the configured tenant geography; Microsoft support and security processing may take place in other countries.

2 Your own providers are not our subprocessors

A Customer's Microsoft 365 (SharePoint and Microsoft Entra ID) or Google Workspace (shared drives and Google accounts) is the Customer's own provider. The Customer chooses it and has its own agreement with Microsoft or Google. Its documents, markup and people list are kept there, and its people sign in there. We reach it only with the grants the Customer gives us, and the Customer can remove them at any time.

The same goes for anything else the Customer connects, such as the security tools it sends activity events to by webhook.

3 Changes to this list

We will update this page, and email Customers' admins or notice contacts, at least 30 days before we add or replace a subprocessor. Customers can object as our DPA describes.

Questions: contact@redlinerhq.app.