Legal
Subprocessors
We keep the list of vendors touching Customer Data intentionally small and review it regularly. This page is the authoritative list for the Data Processing Addendum.
Last reviewed: August 2026
Current subprocessors
| Vendor / role | Purpose | Data | Region |
|---|---|---|---|
| Managed application & database platform | Hosts the Sentinel Vault application, edge server functions, Postgres database, authentication, and encrypted backups. | All Customer Data (encrypted at rest), account identifiers, audit events, request metadata. | Global edge with primary data region in the EU / United States (per project). |
| Transactional email provider | Delivers invitations, verification, security notifications, and password-reset emails from notify.sentinelvault.app. | Recipient email address, display name, and message content necessary for the notification. | United States / EU. |
| Payment processor | Handles subscription billing, invoicing, and card tokenization for paid plans. | Billing contact, company details, and payment-method tokens. Card numbers never touch our servers. | United States / EU. |
| Product analytics (privacy-preserving) | Aggregated feature usage and error telemetry used to improve reliability. | Pseudonymous account id, page path, and error metadata. No vault contents. | EU. |
Change notifications
We will announce intended additions or replacements at least 15 days in advance via in-product notice and by email to organization admins who have opted in to product updates. Customers with a signed Data Processing Addendum may object on reasonable data-protection grounds; see the DPA for the objection procedure.
Standards we apply to subprocessors
- Contractual data-protection terms consistent with GDPR Article 28.
- Encryption in transit and at rest for Customer Data.
- Access limited to personnel with a clear business need.
- Periodic review of the vendor's public security posture.
Vendor names are described by role above to keep this page stable across product changes. Customers who require the current legal names of each subprocessor for their vendor-management program may request them at privacy@sentinelvault.app.