Subprocessors
Last updated: October 2026
Trove uses the following third-party service providers (subprocessors) that process data on our behalf as part of providing the Trove service. We vet each subprocessor for security posture, applicable certifications, and data-processing terms before onboarding them, and we limit access to the minimum data each provider needs to do their job.
The table below lists every vendor that touches customer data, the purpose they serve, the categories of data they process, where that data is stored, and the compliance frameworks each vendor attests to. If you need a copy of a specific Data Processing Agreement, contact us at the email address below.
| Subprocessor | Purpose | Data Processed | Location | Compliance | DPA Availability |
|---|---|---|---|---|---|
| Clerk | Authentication & user management | Email, name, profile image | US | SOC2 Type II | Available |
| PostHog | Product analytics | Usage events, device info (with consent) | EU (Frankfurt) | SOC2 Type II | Available |
| Railway | Application hosting & database | All application data | US | SOC2 Type II | Available |
| Railway Buckets | File storage | Uploaded documents | US | Via Railway SOC2 | Via Railway |
| Polar | Subscription billing | Email, subscription status, payment data (via their payment processor) | EU (Sweden) | GDPR self-certified* | Available |
| Cloudflare | DNS & email routing | Domain traffic metadata, email addresses (routing) | Global | SOC2 Type II, ISO 27001 | Available |
| Resend | Transactional email delivery | Email addresses, email content | US | SOC2 Type II | Available |
| Google Analytics | Website analytics (only with your consent) | Page views, device info | US | Vendor terms | Vendor terms |
| Linear | Support request tracking | Your email, request subject and message | US | Vendor terms | Vendor terms |
| Discord | Internal support alerts | Your email, request subject, short message preview | US | Vendor terms | Vendor terms |
| Slack | Internal new-signup alerts | Your email and name | US | Vendor terms | Vendor terms |
*GDPR compliance is self-reported by the vendor and has not been independently verified.
AI assistants you choose to connect, such as ChatGPT or Claude, are not subprocessors. You authorize them yourself, and their own terms apply.
Data processing is governed by each vendor's standard data processing terms, which are incorporated by reference. For details on specific DPA arrangements, contact [email protected].
Changes to Subprocessors
We commit to providing at least 30 days' notice before adding new subprocessors. To subscribe to updates about subprocessor changes, contact us at [email protected].
Questions
If you have questions about our subprocessors, contact us at [email protected].