DevQuay Subprocessors

Version 0.2 (paid beta) · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-30

This page lists the third parties that process personal data for Joao P M Pereira ("DevQuay") when we provide the Service. It is referenced by the [Data Processing Addendum](data-processing-addendum.md) (section 7) and the [Privacy Policy](privacy-policy.md). We give at least 30 days' notice of a new subprocessor as described in the DPA.

Status legend: Active = in use on the staging environment that becomes production; Planned = used by a feature that is built before paid beta but not yet live. A planned provider is only engaged once its feature ships, and only for Organizations that use that feature.

"Verified" in the location column means the location is stated in DevQuay's own configuration or infrastructure records. "Unverified" means it is taken from the provider's public information and must be confirmed against the provider's DPA before this page is published. Provider legal entity names are also taken from public provider information and must be confirmed against the contract each provider actually holds with DevQuay.

Subprocessors for Customer Content and account data

| Provider | Purpose | Personal data involved | Processing location | Transfer mechanism (for EEA/UK data) | Status | | --- | --- | --- | --- | --- | --- | | Hetzner Online GmbH (Germany) | Hosts the servers of the Kubernetes cluster that runs the DevQuay API, MCP server, background jobs, and the staging PostgreSQL database (production's database is Neon) | All Customer Content and account data stored in the database (member names and emails, audit records, catalog data, content) | Helsinki, Finland (cluster nodes in Hetzner's `hel1` location) — verified (`docs/plan/02-environments.md`, ADR-0001) | None needed (EEA) | Active | | Neon (Databricks, Inc., USA; contracting entity to confirm) | Managed PostgreSQL database for production: all Customer Content and account data stored in the database | As Hetzner above, in production | AWS `eu-central-1`, Frankfurt, Germany (ADR-0033) | EU SCCs per Neon DPA — unverified; owner must accept the DPA | Planned (G10.3) | | Cloudflare, Inc. (USA) | Network proxy, DNS, TLS, DDoS and bot protection for all DevQuay hosts; Workers that render the web app, portals and websites; R2 object storage (media, imports, captures, exports, release and template artifacts, database backups); Workers logs | All data in transit through DevQuay hosts (including IP addresses); Customer Content rendered by the web app; objects stored in R2; database backups | Global edge network for traffic and Workers (verified by design: requests are processed at the Cloudflare location nearest the user). R2 buckets created with location hint Western Europe (`WEUR`) — verified for the application buckets (`infra/cloudflare/terraform/r2.tf`); location of the shared backup bucket `nexus-postgresql-backups` unverified | Per Cloudflare DPA version 6.4, which the Self-Serve Subscription Agreement incorporates; mechanism unverified | Active | | Cloudflare, Inc. — Email Service | Sends transactional email (notifications, invitations outside Clerk) | Recipient email address, message titles and links (no rule text or document bodies) | Unverified | As Cloudflare above — unverified | Planned (G8.4) | | Cloudflare, Inc. — Browser Rendering | Captures public web pages that Users submit as design or technical references | The submitted public URL and the captured page; no DevQuay credentials or user cookies are sent | Unverified (Cloudflare network) | As Cloudflare above — unverified | Planned (G5.8) | | Clerk, Inc. (USA) | User authentication, sessions, organizations and invitations; OAuth authorization server for MCP hosts; authentication emails | Name, email, profile image, authentication identifiers, session data, IP address and user agent, organization memberships | USA — unverified | SCC Modules 2 and 3 and Clerk's EU–US, UK and Swiss Data Privacy Framework certification, per Clerk's published DPA | Active | | Grafana Labs (Grafana Cloud) | Telemetry: traces, logs and metrics from the API, jobs and database | Request metadata (method, route, status, duration), pseudonymous identifiers (organization, request and trace IDs), redacted error messages. Request and response bodies, SQL text and headers are not recorded | São Paulo, Brazil (`prod-sa-east-1`) — verified | EU adequacy decision for Brazil (Implementing Decision (EU) 2026/179); Grafana Labs DPA | Active | | OpenAI, L.L.C. / OpenAI Ireland Ltd (API platform) | Hosted AI drafting, summarisation and analysis, only for Organizations that enable OpenAI | Content excerpts selected for the request (after access-control filtering and secret redaction) and the generated output; no account data beyond an opaque organization reference | USA — unverified | EU SCCs per OpenAI DPA — unverified | Planned (G5.4); staging key provisioned | | Anthropic, PBC (API) | Hosted AI drafting, summarisation and analysis, only for Organizations that enable Anthropic | As OpenAI | USA — unverified | SCCs, in the DPA that is part of Anthropic's Commercial Terms | Planned (G5.4); staging key provisioned | | PostHog, Inc. | Product analytics from allowlisted server-side events and feature flags | Opaque organization and user identifiers, event names and allowlisted properties. No content, prompts, source code, secrets, document bodies or capture contents | United States (PostHog US Cloud); exact location unverified | Per PostHog DPA; mechanism unverified | Planned (G8.4) |

Independent controllers (not subprocessors)

| Provider | Role | Data | Location | | --- | --- | --- | --- | | Paddle.com Market Limited (UK) | Merchant of record and reseller for subscriptions; processes payments, invoices, tax and fraud checks under its own privacy notice | Billing contact name and email, billing address, VAT number, payment method details (DevQuay never receives full card details), transaction history | UK entity; processing locations per Paddle's privacy notice — unverified |

DevQuay receives from Paddle only what it needs to manage the subscription: customer and subscription identifiers, plan, status, billing contact email and transaction status.

Integrations you choose (not subprocessors)

| Provider | What happens | | --- | --- | | GitHub (GitHub, Inc.) | If you install the DevQuay GitHub App, DevQuay reads the repositories you select. The App also has permission to write repository contents and pull requests, and DevQuay uses it only to create a branch and open a pull request when a User explicitly asks. It never merges a pull request. GitHub processes your repositories under your own agreement with GitHub. | | MCP hosts and coding agents (for example Claude Code, Cursor, Codex) | Agents you connect receive the context you authorise through OAuth or service credentials. They are your tools, governed by your agreements with their vendors. DevQuay never forwards your MCP tokens to other services. |

Not subprocessors

The following tools are used to build and operate DevQuay but do not receive Customer Content or customer personal data: GitHub (source code hosting, container registry and CI coordination for DevQuay's own code; CI runs on DevQuay-controlled runners), npm (distribution of the CLI and SDK), and 1Password (storage of DevQuay's operational credentials).

Changes

| Date | Change | | --- | --- | | 2026-10-29 | First version (paid beta draft). | | 2026-10-30 | Seller details added. Grafana Cloud and PostHog locations set, Clerk, Anthropic and Cloudflare transfer details updated, and the GitHub App's write permissions described. |