Subprocessors
Last updated: 23 October 2026
Controller: Nolatech Ltd, Cyprus
Contact: privacy@spandock.com
SpanDock’s self-hosted software processes telemetry on your machines. The subprocessors below support the spandock.com control plane (website, accounts, license checks, billing support)—not your on-prem telemetry database.
We will update this page when we add or replace a material subprocessor. Where we have promised advance notice to enterprise customers, we aim for 30 days before material additions take effect for their accounts.
Current subprocessors
| Provider | Purpose | Location / HQ | Data typically processed | DPA / transfer tool |
|---|---|---|---|---|
| Vercel | Host website, APIs, license/control-plane service | United States (global edge) | Account identifiers, license-check metadata, IPs, logs | Vercel DPA / SCCs as applicable |
| Stripe | Payment processing for Nolatech Ltd (checkout, invoices, tax calculation as configured) | United States / global | Billing identity, plan, tax IDs; card numbers stay with Stripe | Stripe DPA / SCCs; see Stripe privacy notice |
| Resend | Transactional email (sign-in codes, receipts, notices) | United States | Email address, message metadata | Resend DPA / SCCs as applicable |
| PostHog | Product / website analytics (loaded only with consent where required) | EU or US project region as configured | Pseudonymous usage events | PostHog DPA / SCCs as applicable |
| Vercel Analytics / Speed Insights | Website traffic and performance metrics (loaded only with consent where required) | Via Vercel | Aggregate usage / Web Vitals | Covered under Vercel terms / DPA |
| Neon | Managed database for the control plane (accounts, licenses, billing records, support messages) | United States | Account and license data, billing records, messages | Neon DPA / SCCs as applicable |
| Cloudflare | Bot protection on sign-in and contact forms (Turnstile); DNS for spandock.com; the edge service that SpanDock servers and relays call (the relay map, relay admission, server heartbeats and notifications) | United States / global | IP address, browser signals for the bot check; for the edge service, license and installation IDs, server and computer names, and notification text (names and counts, never telemetry) | Cloudflare DPA / SCCs as applicable |
| Google Cloud | Hosts the SpanDock relays that carry encrypted connections between your machines | United States / regions as deployed | IP addresses; tunnel traffic stays end-to-end encrypted and unreadable to the relay | Google Cloud DPA / SCCs as applicable |
| Google Firebase Cloud Messaging | Delivers push notifications from your server to the SpanDock mobile app, on phones that turned notifications on | United States / global | The phone's push token, the server's name, and the notification's text (names and counts, never telemetry) | Google Cloud DPA / SCCs as applicable |
| Documenso | Electronic signing of NDAs and contracts with Nolatech Ltd | As configured by Documenso | Signer name, email address, signature and signing events | Documenso DPA / SCCs as applicable |
Not listed as third-party subprocessors
- On-site Spander chat — first-party support UI operated by Nolatech on spandock.com (same control plane as the website). Support is also available at support@spandock.com.
- Separate error-monitoring, object-storage, or ticketing vendors: none, unless added later to this list.
Payments note: Stripe processes payments for Nolatech Ltd. Whether Stripe also acts as merchant of record for any plan is to be confirmed.
GitHub (update checks from SpanDock/spandock-releases) and OpenRouter (public model price list) are contacted by the customer-installed app, not as Nolatech subprocessors processing your account database. They are listed here for transparency about ancillary egress—not as processors of SpanDock account personal data.
Independent controllers / identity providers
| Party | Role |
|---|---|
| Stripe | Processes payments for Nolatech Ltd; card data under Stripe’s terms. |
| Google / GitHub (if you choose social sign-in) | Identity providers under their terms for the auth handshake |
Customer-chosen destinations (not our subprocessors)
If you configure Langfuse, Grafana Cloud, New Relic, OTLP endpoints, or model providers inside SpanDock, you are sending data to those vendors under your contracts. They are not Nolatech subprocessors.
Prior versions
| Date | Change |
|---|---|
| 7 October 2026 | Initial public list: Vercel, Stripe, Resend, PostHog, Vercel Analytics / Speed Insights |