Transparency
Sub-processor List
Providers Booqiva expects to use for the production service. Final account regions and entities are verified before launch.
Version 2026-07-31
Current production plan
| Provider | Purpose | Data | Safeguard |
|---|---|---|---|
| Cloudflare Workers | Application hosting, delivery and abuse protection | Account, request and technical data | Cloudflare DPA and applicable transfer safeguards |
| Supabase | Managed PostgreSQL database and backups | Workspace and account data | Frankfurt EEA region, provider DPA and access controls |
| Stripe | Subscriptions, connected payments, tax and billing portal | Billing identity, tax IDs and payment metadata | Stripe DPA and applicable transfer safeguards |
| Resend | Transactional email and delivery events | Recipient, message content and delivery metadata | Resend DPA and applicable transfer safeguards |
| Cloudflare R2 | Managed images, documents and attendance evidence | Uploaded files and object metadata | Private bucket, scoped access and provider DPA |
| Sentry | Error monitoring and release diagnostics | Redacted technical events | PII disabled, restricted retention and DPA |
| Google Maps Platform | Location search, maps and distance calculations | Search/location requests and technical metadata | Google data-protection terms |
| Cloudflare Turnstile | Bot and abuse protection | Security and device/network signals | Cloudflare data-protection terms |
Material changes will be posted here and notified to affected customers where required by the DPA. Provider entity, processing region, DPA and transfer mechanism must be recorded in the launch register before production data is enabled.