Subprocessors

ShareMyPage uses a small number of third-party subprocessors to deliver the service. Each is bound by a data processing agreement and holds recognized security certifications (SOC 2 Type II and/or ISO 27001). This list is kept current; material changes are communicated to customers with an active DPA. Last updated: June 2026.

Primary data region: page content (Blob), the database (Postgres), and serverless compute run in the European Union (Frankfurt); transactional email (Brevo, France) and product analytics (PostHog, Frankfurt) are processed in the EU. Only auth (Clerk) and payments (Stripe) process limited data in the US, covered by the EU Standard Contractual Clauses.

Subprocessor	Purpose	Data processed	Location
Vercel	Application hosting, serverless compute, content (Blob) storage, and cookieless web analytics	Page HTML, application requests	European Union (fra1, Frankfurt) — Blob storage + serverless compute; global CDN edge
Neon	Managed Postgres database	Page metadata, versions, folders, comments, tokens, audit log	European Union (AWS eu-central-1, Frankfurt)
Clerk	Authentication and identity (Google/Microsoft OAuth, organizations)	Name, email, workspace membership	United States
Upstash	Rate limiting (Redis)	Transient request counters (no content)	Global edge · transient counters only
Stripe	Subscription billing and payments	Billing contact and payment metadata	United States / EU
Brevo	Transactional email (welcome, comment notifications, invitations)	Recipient email, names, and email content	European Union (France)
PostHog	Product analytics and session replay (cookieless)	Pageviews, UI interaction events, approximate location from IP; never page content	European Union (Frankfurt)

Identity providers (Google, Microsoft) process authentication on your behalf when your users sign in; they are not subprocessors of your page content.