Every company that processes customer data for Asynchrone Space, with its purpose, location and transfer mechanism.
Last updated October 29, 2026
Download PDFA sub-processor is a company we engage to process personal data on your behalf as part of the service. We keep the list short: every entry below is a provider whose systems can see customer data while the product runs.
This list forms part of our data processing agreement with customers (asynchrone.space/legal/dpa). It applies to every workspace; optional features send data only to the provider that powers them.
| Sub-processor | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| OVHcloud | Hosting of the application and of the PostgreSQL database that stores workspace data and uploaded files | All customer data | France, European Union (Gravelines) | No transfer outside the EEA |
| Resend | Transactional email: address verification, password reset, workspace notifications | Name, email address, message content | United States | Standard Contractual Clauses; EU-US Data Privacy Framework where certified |
| OpenAI | AI assistant responses and tool use, only when a workspace enables the assistant | The prompts and content you include in a request | United States | Standard Contractual Clauses; EU-US Data Privacy Framework where certified |
| GitHub | Repository sync and optional OAuth sign-in | Issues and pull requests you sync, your GitHub identity | United States | Standard Contractual Clauses; EU-US Data Privacy Framework where certified |
| GitLab | Repository sync and optional OAuth sign-in | Issues and merge requests you sync, your GitLab identity | United States | Standard Contractual Clauses; EU-US Data Privacy Framework where certified |
| Stripe | Plan subscriptions, invoices and tax | Billing contact, address and tax identifiers; card details go straight to Stripe and never reach our servers | Ireland, European Union (Stripe Payments Europe); United States for group support functions | EU/EEA processing; Standard Contractual Clauses where a US entity is involved |
| Cloudflare | Turnstile captcha on sign-up and password reset, only when the deployment enables it | IP address and browser signals | Global edge network; United States | Standard Contractual Clauses; EU-US Data Privacy Framework where certified |
Last reviewed October 29, 2026. OpenAI, GitHub, GitLab and Cloudflare only receive data when the corresponding feature is used, and Resend and Stripe only when email or billing is configured.
We tell workspace owners by email at least 30 days before a new sub-processor starts processing personal data, and update this page at the same time. The review date above tells you how current the list is.
If you object within those 30 days on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.
Each provider is bound by a data-processing agreement with terms no less protective than our customer DPA: confidentiality, security measures, breach notification, deletion on termination and audit rights.
Where a provider processes data outside the EEA, we rely on the Standard Contractual Clauses (module two) and, where the provider is certified, the EU-US Data Privacy Framework. Hosting and the PostgreSQL database stay in the European Union.
Questions about a provider, or a request for the signed agreements behind this list: privacy@asynchrone.space.