Subprocessors

Cowliss engages the subprocessors below to provide the service (GDPR Art. 28(2)). This page is the canonical list and is incorporated into the DPA by reference.

Changes

Changes to this list are published here before the new subprocessor processes any tenant data. Check this page as part of your own review; Cowliss sends no separate notice. If you object to a change, write to [email protected]; where an objection stands, you may terminate (Art. 28(2)).

Third-party subprocessors

Subprocessor	Role	Tenant data it processes	Location
Amazon Web Services (SES)	Email delivery	Recipient email addresses, rendered message content, delivery, bounce and complaint events	AWS infrastructure
Clerk	Authentication and organization membership	The controller’s team members: names, emails, sign-in metadata. Never end-user data	Clerk’s cloud (United States)
Stripe	Payment processing for subscriptions and wallet top-ups	The billing contact’s payment details. No end-user data	Stripe’s own infrastructure
Hetzner	Hosting provider for the operator’s server	Everything stored by the service, at rest on rented hardware; Hetzner has no application-level access	Helsinki, Finland (EU)
Cloudflare	DNS and reverse proxy for the dashboard, docs and website; R2 object storage for database backups	Dashboard traffic in transit, including profile data your team views (the ingestion API is not proxied), and encrypted-in-transit database backups at rest	Cloudflare’s global network; backups in Cloudflare R2
New Relic	Log storage and alerting	Operational logs: request ids, organization ids, paths, timings, error text. Traits, event properties, message payloads and recipient addresses are redacted before a line leaves the server	European Union

End-user data (profiles, events) leaves Cowliss’s own storage for exactly one subprocessor: AWS SES, at send time, carrying the recipient address and the rendered message. Hetzner holds it at rest, Cloudflare carries it in transit when a team member views it and stores the database backups, and New Relic sees redacted log lines about it.

Operator-run infrastructure

The rest of the stack is software Capital Enesti Inc. runs itself on infrastructure it rents. These are not third-party subprocessors; they are listed so the hosting arrangement is on the record:

Component	Role	Hosting
Temporal	Durable automation workflow state	The operator’s server, Helsinki, Finland (EU)
Postgres	Profiles, traits, consent, registries, ledgers	The operator’s server, Helsinki, Finland (EU)
ClickHouse	The append-only event stream	The operator’s server, Helsinki, Finland (EU)

The hosting location may change; this page is updated when it does.