Subprocessors
Sitebase uses a deliberately small set of providers. These subprocessors may process customer personal data as described in the Data processing addendum. Last updated June 12, 2026.
Cloudflare, Inc.
- Location: USA (global edge network)
- Purpose: Hosting and infrastructure: application runtime, databases (one isolated database per customer), object/key-value storage, queues, bot protection (Turnstile), and email routing.
- Transfer safeguards: EU–US Data Privacy Framework; Cloudflare DPA with SCCs.
Resend, Inc.
- Location: USA
- Purpose: Transactional email: sign-in links, collaborator invites, subscriber double opt-in confirmations, and submission notifications.
- Transfer safeguards: Resend DPA with SCCs.
Polar Software, Inc.
- Location: USA
- Purpose: Billing as merchant of record: checkout, payment processing, invoices, and tax. Polar acts as an independent controller for the payment transaction itself.
- Transfer safeguards: Polar DPA with SCCs.
Other third-party services
These services receive limited personal data of account holders only (never your visitors' data), so they are not subprocessors under the DPA:
- Gravatar (Automattic, Inc., USA): if you have not set a custom avatar, your dashboard avatar is requested from Gravatar using a hash of your account email. Set any custom avatar URL in your profile to opt out.
Changes
We update this page at least 14 days before adding or replacing a subprocessor. Questions or objections: hello@sitebase.dev.