Subprocessors
Version 0.1 · Effective October 31, 2026 · Draft pending counsel review
These are the companies that process personal data for TrustBox LLC, to run trustbox.dev, customer admin and the trust centers we host. Our privacy policy says what personal data we hold, and our data processing agreement says how we handle customers' data. Questions: privacy@trustbox.dev.
Cloudflare, Inc.
- What for: hosting and delivering every TrustBox site; the database and file storage that hold customer content, accounts and access logs; the queues that carry access events; sending email (sign-in links, invites, billing and access-denial notices); cookie-free visit analytics on trustbox.dev; sign-in to the internal TrustBox staff console; and, if we turn it on, a bot check on the sign-up form.
- Personal data: everything in the privacy policy except card details: names, email addresses and phone numbers from sign-up, customer staff and agency users' email addresses, access logs (including IP addresses and user agents), and the contents of the emails we send.
- Where: the database and file storage are placed in Cloudflare's eastern North America region. Requests are handled by Cloudflare's global network, in the data center nearest the visitor.
- Company location: United States.
Stripe, Inc.
- What for: taking payments, subscriptions and invoices.
- Personal data: the name, email address, billing address and payment card of the person who pays, and their invoices and payment history.
- Where: United States.
- Company location: United States.
Before we add or replace one
We plan to add an email provider to fall back on when our primary one fails, and an outside uptime monitor for our own service. Neither processes personal data today, and neither is chosen yet.
Before any new subprocessor processes customers' personal data, we'll list it here and email customers at least 30 days ahead. Customers can object under the data processing agreement. Each version of this page has a number and an effective date, and earlier versions stay published at trustbox.dev/subprocessors with their numbers.