# Subprocessors

> Part of the Cowliss docs. Markdown for every page: append `index.md` to its URL. Site map: /llms.txt

Cowliss engages the subprocessors below to provide the service (GDPR Art. 28(2)). This page is the canonical list and is incorporated into the [DPA](/legal/dpa/) by reference.

## Changes

Changes to this list are published here before the new subprocessor processes any tenant data. Check this page as part of your own review; Cowliss sends no separate notice. If you object to a change, write to support@capitalenesti.com; where an objection stands, you may terminate (Art. 28(2)).

## Third-party subprocessors

| Subprocessor | Role | Tenant data it processes | Location |
| ------------ | ---- | ------------------------ | -------- |
| Amazon Web Services (SES) | Email delivery | Recipient email addresses, rendered message content, delivery, bounce and complaint events | AWS infrastructure |
| Clerk | Authentication and organization membership | The controller's team members: names, emails, sign-in metadata. Never end-user data | Clerk's cloud (United States) |
| Stripe | Payment processing for subscriptions and wallet top-ups | The billing contact's payment details. No end-user data | Stripe's own infrastructure |
| Hetzner | Hosting provider for the operator's server | Everything stored by the service, at rest on rented hardware; Hetzner has no application-level access | Helsinki, Finland (EU) |
| Cloudflare | DNS and reverse proxy for the dashboard, docs and website; R2 object storage for database backups | Dashboard traffic in transit, including profile data your team views (the ingestion API is not proxied), and encrypted-in-transit database backups at rest | Cloudflare's global network; backups in Cloudflare R2 |
| New Relic | Log storage and alerting | Operational logs: request ids, organization ids, paths, timings, error text. Traits, event properties, message payloads and recipient addresses are redacted before a line leaves the server | European Union |

End-user data (profiles, events) leaves Cowliss's own storage for exactly one subprocessor: AWS SES, at send time, carrying the recipient address and the rendered message. Hetzner holds it at rest, Cloudflare carries it in transit when a team member views it and stores the database backups, and New Relic sees redacted log lines about it.

## Operator-run infrastructure

The rest of the stack is software Capital Enesti Inc. runs itself on infrastructure it rents. These are not third-party subprocessors; they are listed so the hosting arrangement is on the record:

| Component | Role | Hosting |
| --------- | ---- | ------- |
| Temporal | Durable automation workflow state | The operator's server, Helsinki, Finland (EU) |
| Postgres | Profiles, traits, consent, registries, ledgers | The operator's server, Helsinki, Finland (EU) |
| ClickHouse | The append-only event stream | The operator's server, Helsinki, Finland (EU) |

The hosting location may change; this page is updated when it does.