Last updated 10-14-2026
Subprocessors
These providers may process customer personal information only to deliver, secure, support, or measure Aestro.
On this page
Current providers
| Provider | Purpose | Location | Information |
|---|---|---|---|
| Supabase Pte. Ltd | Authentication, PostgreSQL database, file storage, security controls, backups, and service logs. | Contracting entity in Singapore; the current Aestro customer database is hosted in AWS US West. Support and additional provider locations are described in Supabase's current DPA. | Account identifiers and the workspace records or files a customer chooses to store. |
| Vercel Inc. | Website delivery, server routes, network security, deployment logs, anonymous Speed Insights, and anonymous Web Analytics. | Global delivery network with processing that may occur in the United States and other provider locations. | Requests to Aestro, server logs, and anonymous page-performance details. Sensitive product routes are excluded from Speed Insights and Web Analytics. |
| Resend (Plus Five Five, Inc.) | Sending account email and the emails a customer sends through Aestro to their clients and signers, and reporting whether each was delivered. | United States, with processing that may occur in other provider locations. | Recipient names and email addresses, the email's contents and links, and delivery events. |
| Cloudflare, Inc. | The bot check (Turnstile) on sign-up. | Global network with processing that may occur in the United States and other provider locations. | The visitor's IP address and browser signals needed for the check. No workspace information. |
| Stripe, Inc. | Pro subscription checkout, billing, and the subscription management page. | United States, with processing that may occur in other provider locations. | Account name and email, subscription status, and payment details entered on Stripe's own pages (Aestro never receives card numbers). |
Transfer safeguards
Aestro requires current data-processing terms covering the production account before release. Where European information is transferred outside the EEA, Aestro relies on the European Commission's Standard Contractual Clauses, applicable adequacy decisions, and provider security commitments under the relevant service agreement. Provider plan eligibility and the applicable contract version are reviewed before release and during the annual vendor review.
Changes and objections
Aestro will post a new subprocessor here before it begins processing customer workspace information where practical. Customers may object on reasonable data-protection grounds by contacting support@aestro.app. Aestro will work in good faith on an alternative; if none is reasonably available, either side may end the affected service.
Not subprocessors
People a workspace owner invites, public-link recipients, and services a user independently chooses to send exports to act under that user's direction and are not Aestro subprocessors. Apple may separately process App Store or Sign in with Apple information under its own terms when those services are used.