Documents · Data

Sub-processor Registry

Every third party that can touch partner data, and when it joined.

In short

Five names, each with its region and its own DPA.

We announce any addition 30 days before it takes effect, and you may object.

No participant data reaches the payment or email providers.

1.The registry

Current as of the date below. This list is the authorisation given under clause 7 of the Data Processing Agreement.

Provider	What it does	Data it can see	Region	Since
Supabase	database, authentication, file storage	accounts, organizations, activities, messages, uploaded photos	EU (AWS eu-west-1, Ireland)	2026-01-01
Apple	push notifications through APNs	device token, notification payload	Global (Apple infrastructure)	2026-01-01
Stripe	card payments	paying director's billing contact and payment metadata; no participant data, no card numbers reach FND	EU and US (SCC-backed)	2026-05-01
Vercel	hosting for findndo.app and the web cabinet	request logs and IP addresses, short-lived; no participant records	EU (Dublin, dub1)	2026-05-01
Resend	transactional email: receipts, cabinet credentials, booking confirmations	recipient address and message content for directors and staff; never participants	EU and US (SCC-backed)	2026-05-01

Each provider's own data processing terms are linked from its name. Registry last changed on 2026-07-24.

2.How changes are announced
We email every partner organization at least 30 days before a sub-processor is added or replaced, and this page is updated on the same day the mail goes out.
1. 2.1An organization may object on reasonable data protection grounds within those 30 days.
2. 2.2If the objection cannot be resolved, the organization may end the affected part of the service and receive a refund for the unused part of its term.
3. 2.3FND stays fully liable for its sub-processors' performance.
3.What is deliberately absent
There is no analytics vendor, no advertising network, no customer-data platform, no session-replay tool and no AI provider in this list, because the product does not send data to any of them.
In plain words
The shortest possible list is the point, not an accident.
4.History
Every entry carries the date it was added. Removals are announced in the same way as additions and are recorded in the change log at the bottom of this document.