Sub-processors
Effective: November 4, 2026
What Is a Sub-processor?
A sub-processor is a third party we engage to process personal data on our behalf as part of providing the Service, as described in our Privacy Policy and Data Processing Addendum.
Due Diligence
Before engaging a sub-processor, we review its security and data protection practices and enter into a written agreement requiring it to protect personal data to a standard consistent with our Privacy Policy and Data Processing Addendum.
List of Sub-processors
| Category | Sub-processor | Purpose |
|---|---|---|
| Hosting & Infrastructure | Cloudflare, Inc. | Cloud hosting, content delivery, and object storage. |
| Hosting & Infrastructure | Google Cloud | Cloud hosting for Console and API infrastructure. |
| Database | PlanetScale | Managed database hosting for application data. |
| Queue & Background Jobs | Upstash | Message queue and background job processing infrastructure. |
| Payment Service Providers (PSPs) | Not yet published | Bank Indonesia and OJK-licensed PSPs that process your QRIS and Virtual Account transactions, as described in our Terms of Service. |
| Identity Verification (KYC/KYB) | Not yet published | Verifies merchant identity and business documents during onboarding. |
| Email Delivery | Resend | Transactional email delivery. |
| Form Delivery & Spam Protection | Web3Forms | Handles and filters submissions from our Contact and Abuse Report forms. |
| Product Analytics & Error Tracking | PostHog | Product usage analytics and error tracking. See our Cookie Policy. |
| Error Tracking & Monitoring | Sentry | Error tracking and application monitoring. |
| Customer Support | Not yet published | Support ticketing. |
| Status Page | Not yet published | Communicates Service status and incidents. |
| Source Code Management | GitHub | Hosts and manages our source code repositories and CI/CD pipelines via GitHub Actions. |
| Documentation | ReadMe | Hosts our API and developer documentation. |
| Business Operations | Google Workspace | Internal email, calendar, and document collaboration for our team. |
| Secrets Management | 1Password | Secure storage and management of credentials and secrets used to operate the Service. |
Vendor Security Practices
Each sub-processor is contractually bound to implement appropriate technical and organizational measures to protect personal data, consistent with our Data Processing Addendum.
Updates to This Page
We’ll update this page when we add, remove, or replace a sub-processor, or finalize a vendor name in a category above. Where required by our Data Processing Addendum, we’ll give advance notice before a new sub-processor begins processing personal data on your behalf.
Contact
Questions about our sub-processors can be sent to legal@apipay.id.