Trust
Sub-processors
The companies that handle data so Docustay can run.
| Company | What it does for us | What it can see |
|---|---|---|
| Railway | Application and database hosting | All data you store |
| Google Cloud / Firebase | Sign-in and supporting infrastructure | Account email and sign-in identifiers |
| Stripe | Payments and billing | Billing details and payment references; card numbers go to Stripe directly |
| Resend | Sending email | Recipient email address and the message |
| A public time-stamp authority (DigiCert by default) | Trusted timestamp on a signed file | A hash of the document only, never its contents |
Changes
When this list changes we update this page and tell workspace owners before the change takes effect.
What a sub-processor is
A sub-processor is a company Docustay uses to run part of the service, and that therefore may handle some of your data. The table above lists each one, what it does and what it can see. The list is short on purpose.
How you are told about changes
When a company is added or replaced, this page is updated and workspace owners are told before the change takes effect, so you have time to object under the Data Processing Addendum.
What never leaves
Card numbers go from the payer straight to Stripe and never pass through Docustay. A trusted timestamp is requested with a hash of the document only, never the document itself.
How this list is kept
The list names each company that handles data so the service can run, what it does for Docustay and where it is based. When a company is added or removed, the list changes first and the Data Processing Addendum points to it.
What is not on the list
Companies that only see public traffic to this website, such as a visitor's own network provider, are not sub-processors. Nothing on this site loads from a third party: fonts, images and scripts are served from Docustay itself.
Why the list is short
Docustay is a small product and runs on a small number of services: somewhere to run the application and its database, sign-in, email delivery, payment processing for the plans and a time-stamp authority for signed files. Each name on the list is there because removing it would stop that part of the service from working.
Asking a question
If you need to know more about a company on the list, or want to be told when the list changes, write to us through the Contact page.