Current subprocessors

• Hetzner - application hosting and compute infrastructure. DPA.
• Supabase - managed PostgreSQL database infrastructure and backups. DPA.
• Cloudflare - EU-jurisdiction R2 object storage and delivery for uploaded files, backups, and generated exports, plus Turnstile abuse protection. DPA.
• Resend - transactional email delivery for authentication, invitations, and operational notices. DPA.
• PostHog - optional browser analytics when analytics consent is enabled, plus service-side product instrumentation and feature-flag support. DPA.
• Sentry - operational error monitoring and optional browser diagnostics when diagnostics consent is enabled. DPA.
• FirstPromoter - referral program: referrer accounts and payouts, referral link tracking when marketing consent is enabled, and server-side signup, payment, refund, and cancellation events for referred paid organizations. DPA.
• Featurebase / CORDNET OÜ - EEA-hosted customer feedback and issue submissions plus connection metadata; Reform does not programmatically send account profiles, email addresses, organization identifiers, or SSO identities. DPA.

Region and transfer notes

reform is configured to use European-region options for core application hosting, database infrastructure, browser telemetry, and object storage where those options are available.

Core application hosting, database infrastructure, browser telemetry, and object storage are configured for European-region processing. Transactional email delivery is configured with an Ireland sending region, but Resend’s public GDPR and DPA materials state that customer data may still be processed in the United States under applicable transfer safeguards.

If you need vendor-specific location or transfer details, contact support@paqu.io before production use.

Related third-party services

Some services are described in the Privacy Notice instead of the core subprocessor list because their legal role can differ from a standard subprocessor relationship. This currently includes Stripe Managed Payments / Link for merchant-of-record payments, billing, and transaction support, and Google when you choose social sign-in.

DPA and contracting questions

A customer-facing reform DPA template is published at DPA.

Vendor DPAs are linked above. Questions about contracting, privacy review, or reform-specific DPA discussions can be sent to support@paqu.io.