For customers subject to GDPR, UK GDPR, or CCPA, this DPA forms part of your subscription agreement. We're the processor; you're the controller of your end-customers' data. We process only what you tell us to process and only for the duration of your subscription + the 30-day export window.
Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database, auth, file storage | AWS us-east-1 |
| Vercel | Hosting + edge CDN | Multi-region |
| Stripe | Billing + payment processing | US, IE, AU, SG |
| Resend | Transactional + marketing email | US |
| Anthropic | LLM inference | US |
| Inngest | Durable workflow execution | US |
| Sentry | Error monitoring | US |
| Langfuse | LLM observability | EU (self-host option) |
| Plausible | Page analytics (cookieless) | EU (DE) |
| Cloudflare | DNS, CDN, R2 object storage | Multi-region |
We notify you of sub-processor changes via email + /changelog at least 30 days before they take effect.
Security measures
Encryption at rest (AES-256, via Supabase + R2 defaults). Encryption in transit (TLS 1.2+). Row-level security on every tenant-scoped table. Append-only audit log. Quarterly backup-restore drill. Sentry + Langfuse for production observability with PII redaction.
International transfers
Where personal data of EU/UK data subjects is transferred to a non-adequate jurisdiction, transfers rely on the EU Standard Contractual Clauses (2021/914), counter-signed via DocuSign on request. Email legal@astru.dev.
Sign a counter-signed DPA
Email legal@astru.dev with your company name + signing-party contact. We send the DocuSign within 1 business day.