Subprocessors

Last updated: November 10, 2026

In short

These are the companies that help Kardow run your board and may handle its users’ personal data. Under our Data Processing Agreement, we tell account owners before adding or replacing one, and you can object.

DPF: certified under the EU-U.S. Data Privacy Framework. SCCs: the European Commission’s standard contractual clauses, in the provider’s data processing terms.

Some providers only handle a board’s data when a feature that needs them is in use, such as AI features, a root custom domain or the mobile app.

ProviderPurposeLocationSafeguard
Amazon Web ServicesCloud infrastructure and email deliveryUnited StatesDPF, SCCs
SupabaseDatabase and file storageUnited StatesSCCs
CloudflareHosting, content delivery and securityGlobal network, United StatesDPF, SCCs
Hetzner OnlineCloud hostingUnited StatesSCCs
UpstashCloud infrastructureUnited StatesSCCs
ResendEmail deliveryUnited StatesDPF, SCCs
OpenAIAI featuresUnited StatesSCCs
AnthropicAI featuresUnited StatesSCCs
GroqAI featuresUnited StatesSCCs
VercelAI featuresUnited StatesSCCs
MapboxLocation servicesUnited StatesDPF, SCCs
GoogleLocation servicesUnited StatesDPF, SCCs
SentryError monitoringUnited StatesDPF, SCCs
TinybirdAnalyticsUnited StatesSCCs
SaaS Custom DomainsCustom domain hostingUnited StatesSCCs
NovuMobile app notificationsUnited StatesSCCs
ExpoMobile app notificationsUnited StatesSCCs

Services you connect yourself

Tools you add to your own board, such as your Stripe or PayPal account, Google or LinkedIn sign-in, Google Analytics, advertising pixels, Zapier, webhooks or your own email server, work under your own agreement with that provider. They are your providers, not Kardow’s subprocessors.

Kardow’s own business

The tools we use for our own website, billing and support (for example Stripe for your Kardow subscription and our support chat) handle your account details, not your board users’ data. Our Privacy Policy covers them.

Changes and objections

We email account owners and update this page before a new subprocessor starts handling board data. To object, reply to that email or write to support@kardow.com within the notice period. Section 6 of the DPA explains what happens next.