Subprocessors

Subprocessor list last changed: 11 June 2026 · Page version 1.2 (24 July 2026)

ProcuLink uses the following subprocessors to deliver the Service. Each subprocessor is bound by a written data-processing agreement aligned with the requirements of GDPR Article 28.

Current subprocessors

Subprocessor	Purpose	Location	Contract
Railway	API and background-worker hosting	EU region	Railway DPA
Neon	PostgreSQL database hosting	EU region	Neon DPA
Cloudflare	R2 object storage (order files and the output files we generate) and DNS	EU-region bucket	Cloudflare DPA
Vercel	Website and app hosting (order files do not pass through it)	Global CDN	Vercel DPA + SCCs
Clerk	Authentication and session management	US, EU data residency available	Clerk DPA + SCCs
OpenAI	AI document extraction and mapping suggestions (API data is not used for model training under OpenAI's API terms)	US	OpenAI DPA + SCCs
Stripe	Payment processing and subscription management	US, EU establishment	Stripe DPA + SCCs
Postmark	Email in and out: orders emailed to your ProcuLink address, and the purchase orders we email to your suppliers	US	Postmark DPA + SCCs
PostHog	Pseudonymous product analytics	EU (eu.posthog.com)	PostHog DPA
Sentry	Error monitoring and diagnostics	EU region	Sentry DPA

Planned changes

No subprocessor additions or replacements are currently planned. Anything pending appears here, with its effective date, before it starts processing customer data.

30 days' advance notice, published here. Before a new or replacement subprocessor starts processing customer data, it is published under Planned changes above — with the date it takes effect — at least 30 days beforehand. This page is the source of truth for that commitment: the list carries the date it last changed, and a pending change carries the date its notice went up, so you can check the 30 days rather than take our word for it.

How to object

Customers who object to a planned subprocessor have 14 days from the notice date shown above to raise the objection in writing, to legal@proculink.eu. Where the objection cannot be resolved, the customer may terminate the subscription without further fees for the unused remainder of the term.

We do not operate a notification mailing list — the notice is the dated publication on this page, which means it does not depend on anyone remembering to send it. Customers who need the notice delivered to a named contact can have that written into their agreement; email the address above.