Active sub-processors
Neon, Inc.
- Purpose
- Primary PostgreSQL database — stores all app-user, payer, and chart employee data
- Data categories
- All PII categories: identity/contact (email, name, avatar), auth tokens, account/role, consent records + checkout attribution + analytics join-key sources, billing identifiers, org-chart employee data (names, titles, departments, reporting lines). The consent-gated behavioral event stream is delivered to Rybbit after cutover.
- Region
- AWS us-east-1 (United States)
- Transfer basis
- EU-US Data Privacy Framework (DPF) + EU SCCs 2021/914 + UK IDTA/Addendum
- Privacy policy
- https://neon.tech/privacy-policy
- Notes
- Primary data store; CLOUD Act reach persists regardless of region.
Vercel, Inc.
- Purpose
- Application hosting, edge delivery, serverless functions — all PII transits Vercel
- Data categories
- All PII categories in transit: request/response bodies including export buffers, auth tokens in headers, analytics payloads
- Region
- US (default iad1; region not currently pinned — see D5)
- Transfer basis
- EU-US DPF + EU SCCs 2021/914 + UK IDTA/Addendum
- Privacy policy
- https://vercel.com/legal/privacy-policy
- Notes
- Region pinning to fra1 is planned (D5) for EU accounts.
Stytch (Twilio, Inc.)
- Purpose
- User authentication, magic-link delivery, OAuth (Google), session management
- Data categories
- Identity/contact: email, name, OAuth profile data; auth: session tokens, provider IDs
- Region
- United States
- Transfer basis
- EU-US DPF (Twilio, Inc. participant #5394)
- Privacy policy
- https://stytch.com/legal/privacy
- Notes
- DPF basis confirmed for Twilio/Stytch. SCC fallback DPA execution pending confirmation.
Stripe, Inc.
- Purpose
- Payment processing for export passes — card checkout AND programmatic (x402) USDC settlement, which runs entirely through Stripe (deposit-mode crypto payments; no external facilitator)
- Data categories
- Billing identifiers (Stripe customer ID, subscription ID); Stripe holds payment card data on its own servers — OCS does not receive or store card numbers. For x402 USDC payments, Stripe mints a per-payment crypto deposit address and detects the on-chain deposit; the payer's public wallet address may be surfaced to Stripe on the charge (pseudonymous, not stored by OCS). OCS stores checkout metadata (session ID, amount, currency, UTM attribution) in its own database.
- Region
- United States
- Transfer basis
- EU-US DPF + EU SCCs 2021/914
- Privacy policy
- https://stripe.com/privacy
Rybbit
- Purpose
- Consent-gated product analytics and, under a separate consent purpose, session replay across the site and chart studio
- Data categories
- Product events: opaque user/account/anonymous/session identifiers, event names, URL paths without query strings, browser/user-agent information, and PII-scrubbed usage/attribution properties. No names, email addresses, raw query strings, stored IP addresses, or org-chart employee data are sent in the event payload. Replay: DOM changes and interactions across the site excluding sign-in/verification, OAuth, and checkout routes; inputs ignored/masked; chart-node employee text (names, titles, custom fields) replaced with neutral placeholder text in-browser before transmission; employee-data surfaces (people list, export previews, import comparisons) and iframes blocked; opaque first-party actor id only. Rybbit necessarily receives the replay request IP transiently; Track IP Address is disabled.
- Region
- Primary cloud application and analytics on Hetzner in Germany/EU; encrypted session-replay objects on Cloudflare R2
- Transfer basis
- Rybbit Data Processing Agreement; EU Standard Contractual Clauses or other safeguards for processing outside the EEA where applicable
- Privacy policy
- https://rybbit.com/privacy
- Notes
- Rybbit's DPA is at https://rybbit.com/dpa. Public analytics, URL-parameter tracking, automatic pageviews/navigation/autocapture, and IP storage are disabled for the Org Chart Studio property.
Google LLC (Google Analytics + Google Tag Manager)
- Purpose
- Google Analytics provides consent-gated web analytics and traffic measurement after analytics consent. Google Tag Manager additionally coordinates optional advertising conversion tags and loads only after both analytics and marketing-measurement consent.
- Data categories
- Online identifiers: IP address (anonymized per GA4 configuration), Google Analytics client ID, GA session ID, device/browser identifiers, behavioral telemetry (pages visited, events), referrer
- Region
- United States (Google LLC US entity processes EU data)
- Transfer basis
- EU-US DPF (Google LLC participant #5780) + EU SCCs
- Privacy policy
- https://policies.google.com/privacy
- Notes
- Disclosed in privacy policy §4.6 and §8. Google Analytics is not loaded until analytics consent is accepted; Google Tag Manager also requires marketing-measurement consent. Collection was paused from 2026-07-17 during an analytics migration and subsequently reinstated.
Legacy processors during migration
These providers receive no new analytics or replay data after the Rybbit production cutover, but remain processors while historical data is retained for migration validation, rollback, or expiry.
LogRocket, Inc.
- Purpose
- Legacy consented session-replay history; no new recordings after the Rybbit cutover
- Data categories
- Historical replay, interaction, and identified-user data collected under the prior masking configuration
- Region
- United States
- Transfer basis
- EU-US DPF + EU SCCs
- Privacy policy
- https://logrocket.com/privacy/
- Notes
- Remove from this list after the retained replay data and account are deleted.
Tinybird (Tinybird Analytics S.L.)
- Purpose
- Legacy full-fidelity analytics archive and emergency rollback; no new event or operational-dimension writes after Rybbit cutover (erasure tombstones may still be written)
- Data categories
- Pseudonymous event history and non-PII operational dimension keys collected before cutover; no email address or org-chart employee data
- Region
- GCP europe-west3 (Frankfurt, EU)
- Transfer basis
- EU-resident processor; EU/EEA hosting
- Privacy policy
- https://www.tinybird.co/privacy-policy
- Notes
- Retained during migration validation because Rybbit's supported CSV import cannot preserve arbitrary event properties, account ids, or exact millisecond ordering.
Planned sub-processors (not yet active)
The following sub-processors are planned but not yet receiving personal data. This list will be updated and the active table above will be amended before any data flows to these services.
SendGrid (Twilio) and/or Email Octopus
- Purpose
- Transactional and marketing email (F12 — not yet procured)
- Region
- TBD at procurement
- Notes
- DPA/SCC review required at procurement. Sub-processor list will be updated before first send.
Questions and requests
If you have questions about our sub-processors or wish to object to the engagement of a new sub-processor (under your DPA rights), please contact us at hello@orgchartstudio.com.