Sub-processors
Effective date: October 10, 2026 · Last updated: October 10, 2026
Summary. WarpLink is operated by Stojanovski Industries Inc., a company in Ontario, Canada. Link requests are handled at the edge location nearest to each visitor, worldwide. Stored data is kept in a database in the United States (Northern Virginia). Dashboard product analytics and session replay, which run only with consent, are processed in the European Union. This page lists every provider that processes personal data for WarpLink, what it receives, and where. We email customers and update this page at least 30 days before a new provider starts processing customer end-user data, and customers can object.
Providers that may process customer end-user data
These providers are sub-processors under our Data Processing Agreement. They may process personal data of the people who open our customers' links or use our customers' apps.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Link redirects, link cache, event queues, custom domain certificates, edge request logs | Visitor IP address and request headers while a request is handled; keyed IP hashes and click events in transit; deferred matching entries; link configuration | Global edge network | Provider data processing terms with EU Standard Contractual Clauses |
| Databricks, Inc. (Neon) | Primary database | Link configuration, click records, install and attribution records, account data | United States (AWS us-east-1, Northern Virginia) | Provider data processing terms with EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports, which can include request URLs and identifiers | United States | Provider data processing terms with EU Standard Contractual Clauses |
| Google Cloud Canada Corporation (Web Risk) | Checking link destinations against threat lists | Link destination URLs | United States and other countries where Google operates | Provider data processing terms with EU Standard Contractual Clauses |
| Upstash, Inc. | Rate limiting for the API, MCP server, and sign-in | Hashed API keys; IP addresses of API, MCP, sign-in, and SDK requests, kept for a few minutes as rate-limit keys. Not the IP addresses of people who open links. | United States (AWS us-east-1, Northern Virginia) | Provider data processing terms with EU Standard Contractual Clauses |
Providers for WarpLink's own data
These providers process data that WarpLink controls itself: account holders, billing, support, sign-in, and our websites. They do not receive customer end-user data, and they are not sub-processors under the DPA. We list them so you can see every provider in one place.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Canada, Ltd. | Payments and subscriptions | Billing contact, payment, and subscription details | Canada and the United States | Provider data processing terms |
| Resend (Plus Five Five, Inc.) | Account, billing, and product email | Recipient email address and message content | United States (AWS us-east-1, Northern Virginia) | Provider data processing terms |
| Google LLC (Google sign-in) | Optional sign-in | Name, email address, and account identifier | United States and other countries where Google operates | Provider terms |
| GitHub, Inc. | Optional sign-in | Name, email address, and account identifier | United States | Provider terms |
| Google LLC (Google Analytics) | Website and dashboard usage analytics, only after cookie consent | Pages visited, browser and device details, analytics cookie identifiers | United States and other countries where Google operates | Provider data processing terms |
| PostHog, Inc. | Dashboard product analytics and session replay, only after cookie consent. Inputs, keys, backup codes, and two-factor secrets are masked. | Dashboard usage events, session recordings, IP address for approximate location | European Union (EU cloud) | Processed in the EU |
| Formspree, Inc. | Contact forms on the website and dashboard | Name, email address, and message | United States and other countries where Formspree operates | Provider data processing terms |
The dashboard sends PostHog data through a relay on our own domain. The relay never forwards dashboard session cookies. It forwards the visitor's IP address so PostHog can estimate location. People who only open WarpLink links never load PostHog.
Changes to this list
We email the owner of every organization and update this page at least 30 days before a new or replacement provider begins processing customer end-user data. A customer may object on reasonable data protection grounds by emailing legal@warplink.app during that period, and we handle the objection as described in Section 7 of the Data Processing Agreement. We update this page when a provider is removed or its role changes.