Subprocessors
Last updated: 11 June 2026 · Version 1.1
ProcuLink uses the following subprocessors to deliver the Service. Each subprocessor is bound by a written data-processing agreement aligned with the requirements of GDPR Article 28.
Current subprocessors
| Subprocessor | Purpose | Location | Contract |
|---|---|---|---|
| Railway | API and background-worker hosting | EU (europe-west4, Netherlands) | Railway DPA |
| Neon | PostgreSQL database hosting | EU region | Neon DPA |
| Cloudflare | R2 object storage (order files and generated artifacts) and DNS | EU-region bucket | Cloudflare DPA |
| Vercel | Frontend hosting and CDN | Global CDN, source data EU | Vercel DPA + SCCs |
| Clerk | Authentication and session management | US, EU data residency available | Clerk DPA + SCCs |
| OpenAI | AI document extraction and mapping suggestions (API data is not used for model training under OpenAI's API terms) | US | OpenAI DPA + SCCs |
| Stripe | Payment processing and subscription management | US, EU establishment | Stripe DPA + SCCs |
| Postmark | Inbound email ingestion (orders emailed to your ProcuLink address) | US | Postmark DPA + SCCs |
| PostHog | Pseudonymous product analytics | EU (eu.posthog.com) | PostHog DPA |
| Sentry | Error monitoring and diagnostics | EU region | Sentry DPA |
30-day change notification. Before adding or replacing a subprocessor, we will give existing customers at least 30 days' prior written notice. To subscribe to subprocessor change notifications, email privacy@proculink.eu with the subject line "Subprocessor notifications". We track the subscriber list manually and will email all subscribers when this page changes.
How to object
Customers who object to a new subprocessor have 14 days from the notice to raise the objection in writing. Where the objection cannot be resolved, the customer may terminate the subscription without further fees for the unused remainder of the term.