Subprocessors
Last updated: 15 October 2026
This page is the official, current version of this document. Printed or saved copies may be out of date — the latest version is always at gracesoft.dev/legal/subprocessors. Printed on .
A subprocessor is a third-party company that may handle personal data on GraceSoft's behalf so that our website and products can work — for example, by hosting a page or delivering an email.
We keep this list short on purpose. Before adding any service, we ask whether we can avoid sharing data at all, and if not, whether the provider meets the same privacy-first, security-first standard we hold ourselves to. Under each provider, you'll find why we chose it. Read more abouthow we build for privacy and security.
Core subprocessors
These services handle data whenever you use our website or the products listed against them.
Vercel
Global edge network; serverless functions in the US
Hosting and content delivery for gracesoft.dev
- Used by
- gracesoft.dev website
- Data handled
- Request metadata (IP address, user agent)
Privacy & security fit
- SOC 2 Type 2 and ISO 27001 certified
- HTTPS everywhere with automatic certificates and built-in DDoS mitigation
- Offers a GDPR Data Processing Addendum
Cloudflare
Global edge network
DNS, content delivery and DDoS protection
- Used by
- Light CMS downloads (assets.gracesoft.dev) · GraceSoft Prayer (prayer.gracesoft.dev) · GraceSoft Capture, including optional Turnstile bot protection
- Data handled
- Request metadata (IP address, user agent) as traffic passes through its network; for Capture forms that enable Turnstile, the challenge signals Turnstile collects
Privacy & security fit
- ISO 27001 and ISO 27701 certified, with an independent SOC 2 Type 2 report
- Certified under the Global Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP)
- Assessed against the EU Cloud Code of Conduct
Pinecone
Cloud region chosen per index
Vector database for search and AI features
- Used by
- GraceSoft product apps
- Data handled
- Vector embeddings and the metadata stored alongside them
Privacy & security fit
- Its Data Processing Addendum includes the EU Standard Contractual Clauses for international transfers
- Contractually barred from selling or sharing the personal data it processes for us
- Commits to notifying us of a security incident without undue delay
Laravel Cloud
United States
Managed application deployment, database hosting and background job queues
- Used by
- GraceSoft Prayer · GraceSoft Capture · GraceSoft product apps
- Data handled
- Account and application data stored in our product databases, and the queued jobs that act on it (such as notification emails and webhooks)
Privacy & security fit
- Customer data is governed by the data processing terms in Laravel's customer agreement
- Uses contractual safeguards for international data transfers
Railway
United States
Backend services and container hosting
- Used by
- GraceSoft product apps
- Data handled
- Application data processed by the backend services we run there
Privacy & security fit
- Its Data Processing Addendum is incorporated into its Terms of Service
- Deletes hosted source code once an account is terminated
Postmark
United States
Transactional and notification emails from our product apps
- Used by
- GraceSoft Prayer · GraceSoft Capture · GraceSoft product apps
- Data handled
- Recipient email address and the content of the notification
Privacy & security fit
- Offers a GDPR Data Processing Addendum, which we have executed
Amazon Web Services (S3)
Region chosen per deployment
Private file storage for uploaded documents and attachments
- Used by
- GraceSoft Desk · GraceSoft Skylight
- Data handled
- Files you upload, such as invoice PDFs, documents and card attachments
Privacy & security fit
- ISO 27001 and SOC 1/2/3 certified
- Objects encrypted at rest by default; public access blocked by default
- We serve files only through short-lived signed links, never public URLs
Stripe
United States, with regional processing
Subscription billing and payments
- Used by
- GraceSoft Skylight · GraceSoft Capture
- Data handled
- Billing name, email and payment details
Privacy & security fit
- PCI DSS Level 1 certified — the highest level for payment processors
- Card details are entered on Stripe's hosted Checkout and never touch our servers
- SOC 2 Type II compliant
Sentry
United States
Error tracking, so we can fix crashes quickly
- Used by
- GraceSoft Skylight
- Data handled
- Technical error reports (stack traces, request metadata)
Privacy & security fit
- SOC 2 Type II and ISO 27001 certified
- Server-side scrubbing of passwords, tokens and other sensitive fields by default
- Used for crash reports only — never to follow what users do
Telegram
Global
Messaging channel for our booking and assistant bots
- Used by
- Sentinel Concierge · Sentinel Cook · GraceSoft Assistant bot
- Data handled
- Messages you send to the bot, and your Telegram account ID
Privacy & security fit
- A bot only sees messages sent directly to it
- Concierge moves names and phone numbers straight into our encrypted identity store — bookings only ever reference a token
- Our assistant bot reads from a read-only API with its own scoped tokens
Messaging channel for our WhatsApp bots
- Used by
- Sentinel Concierge · Sentinel Cook
- Data handled
- Messages and photos you send to the bot, and your WhatsApp phone number
Privacy & security fit
- Messages are end-to-end encrypted in transit to the WhatsApp Business Platform
- Meta operates the Cloud API as a data processor on the business's behalf
Optional integrations
These only receive data if you choose to switch the feature on or connect the account. Leave them off, and they never see a thing.
OpenAI and Anthropic
United States
AI commit summaries, only when you switch AI on
- Used by
- GraceSoft Desk (off by default)
- Data handled
- Commit messages, branch names and stage names, with emails and anything resembling a secret redacted
Privacy & security fit
- Neither provider trains its models on API data by default
- Desk never sends code diffs, author names or author emails, and logs only a hash of each request — never its content
- Desk can point at a local, self-hosted model instead
Global
Sign-in with Google, and Google Drive recipe sync
- Used by
- GraceSoft Skylight (sign-in) · Sentinel Cook (Drive sync)
- Data handled
- Your name, email and profile photo; for Cook, the recipe files you choose to sync
Privacy & security fit
- OAuth means we never see or store your Google password
- ISO 27001 and SOC 2 certified
Sign-in (GitHub) and commit-to-timesheet integration
- Used by
- GraceSoft Skylight (GitHub sign-in) · GraceSoft Desk (repository integration)
- Data handled
- Account profile; for Desk, commit messages and branch names from repositories you link
Privacy & security fit
- Connected through OAuth; access tokens are encrypted at rest and deleted when you disconnect
- Every incoming webhook is verified with the provider's own signature or secret
Slack
Global
Card notifications in your Slack channel
- Used by
- GraceSoft Skylight
- Data handled
- Card titles and event types for the boards you connect
Privacy & security fit
- Uses an incoming webhook you control — it can post to one channel and read nothing
- Disconnect at any time from your workspace's integrations page
What we run ourselves
Some services that are often outsourced, we run on our own infrastructure instead — so your data stays with us and isn't passed to another company.
- Matomo analytics — Self-hosted at analytics.gracesoft.dev. Loads only after you consent, and your data is never shared with advertising networks.
- GraceSoft Capture — Our own form builder, used on this site's contact page and on product sites instead of a third-party form tool. Its embedded forms set no cookies. It runs on the Laravel Cloud, Cloudflare, Postmark and Stripe services listed above — no additional vendors.
- Brand fonts — Served from our own domain, so loading this site never calls a font CDN.
What we never do
- Sell, rent or trade your personal data.
- Share data with advertising networks or data brokers.
- Use a subprocessor to track how you behave inside our products.
Changes to this list
When we add or replace a subprocessor, we'll update this page and its revision date. If you have questions about any provider listed here, contact our Data Protection Officer atdavinaleong@gracesoft.dev.