Sub-processors
Last updated: July 28, 2026
Traceten engages a limited number of third-party service providers ("sub-processors") to operate the analytics service. Active providers are listed first, followed by any planned providers listed ahead of launch. Each provider is contractually bound to security obligations no less protective than those in our Data Processing Agreement.
We notify customers at least 30 days before adding a new sub-processor that processes personal data, by updating this page and emailing the primary administrative contact on the customer's account.
To subscribe to sub-processor change notifications, email legal@traceten.com with the subject "Sub-processor notifications" and the email address you would like added.
Active sub-processors
These providers are live and process personal data on our behalf today. Engaging them is authorised under Section 8 of the Data Processing Agreement.
| Provider | Purpose | Location | Data terms |
|---|---|---|---|
| Cloudflare, Inc. | Edge ingestion (Workers), DDoS protection, IP hashing at the edge. | Global edge; primary entity United States. | DPA |
| ClickHouse, Inc. (ClickHouse Cloud) | Analytics event storage and query (hot tier, 90 days). | United States. | DPA |
| Neon (Databricks, Inc.) | Postgres metadata database (accounts, sites, integrations). | United States. | DPA |
| Upstash, Inc. | Redis cache for sessions and rate-limit counters. | United States. | DPA |
| Redpanda Data, Inc. (Redpanda Cloud) | Event streaming bus between ingestion and the classification engine. | United States. | DPA |
| Clerk, Inc. | Authentication and identity for the customer dashboard. | United States. | DPA |
| Stripe, Inc. | Subscription billing and payment processing for Traceten customers. | United States. | DPA |
Planned sub-processors
The providers below are listed ahead of launch and are not yet processing personal data. Listing them here is advance visibility, not the formal notice: a planned provider is only authorised once it moves to the active list above, and that promotion triggers a fresh 30-day notice and objection window (see Section 8 of the Data Processing Agreement). No planned provider begins processing personal data until that window has run.
| Provider | Purpose | Location | Data terms |
|---|---|---|---|
| Amazon Web Services, Inc. | Planned cold storage of historical events in S3 (Parquet, SSE-KMS encrypted). Not yet in production; listed ahead of launch. | United States. | DPA |
Data residency
All personal data listed above is processed in the locations named in the tables above. You select a region when you create a site and we record it, but region-based storage routing is not yet in place, so that setting does not currently change where data is held. EU residency is not available yet. An earlier version of this page said we configure the providers above to use their EU regions on request. That was not accurate, and this is the correction.
Transfers out of the EEA, the UK, and Switzerland rely on the EU Standard Contractual Clauses incorporated into our Data Processing Agreement. We will update this page and notify affected accounts before region routing goes live. If EU residency is a requirement for you, contact legal@traceten.com before you rely on it.
Changes to this list
Material changes to this page (addition, removal, or change of role of a sub-processor that processes personal data) are dated and announced as described above. The "Last updated" date at the top of this page reflects the most recent change.