Vendor & Sub-Processor List
Last updated: 6 November 2025
We use trusted third-party service providers ("sub-processors") to deliver and support the BoothPass platform. Each vendor processes limited personal data on our behalf and is bound by a Data Processing Agreement (DPA) and appropriate international transfer safeguards (e.g., Standard Contractual Clauses).
Current Sub-Processors
| Vendor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication | User accounts, booking data | EU (Frankfurt), US |
| Railway Inc. | Application hosting | Application-level data | US |
| Cloudflare Inc. | CDN, DDoS protection | IP addresses, request metadata | Global |
| PostHog Inc. | Analytics (consent-based) | Usage data, session replay | US |
| Resend Inc. | Transactional email | Email address, message metadata | US |
| Google LLC (reCAPTCHA) | Bot protection | IP address, interaction data | US / Global |
Infrastructure Providers (No direct access to personal data)
| Vendor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Underlying infrastructure (via Railway/Supabase) | US / Global |
| Cloudflare R2 | Object storage | Global |
Business Operations (No BoothPass user data processed)
| Vendor | Purpose | Data Processed |
|---|---|---|
| Microsoft Corporation | Company email & internal documents | Company administrative data |
| Stripe Inc. | Payments (if used) | Payment data (processed by Stripe, not stored by us) |
Changes to Sub-Processors
We will update this page when:
- A new vendor is added
- A vendor is removed
- Processing purpose changes
For registered BoothPass users, material changes will be notified by email when required.