Sub-processors
Effective Date: 9 October 2026
Last Updated: 9 October 2026
Version: 2026-10-09
1. What this list is
These are the providers that process personal data in Customer Content for us, or that are likely to, as our sub-processors under the Data Processing Addendum. "In use (Preview Environment)" means the provider is part of the Service as we build and test it today in our own preview environment, in some cases through a local stand-in for the provider's service, with test data only: the production service has not opened, so none of these providers yet processes any Customer's content, and each becomes "In use" on the day it does. "Planned" means it does not yet process Customer Content, in the preview environment or otherwise; we will give the notice in section 3 before it does. We remain responsible for each of them.
2. Sub-processors
| Provider | What it does for us | Customer data it handles | Where | Status |
|---|---|---|---|---|
| Supabase, Inc. | Database, user authentication and the server-side functions of the Service | Account and activity records, permissions, questions and answers, and the metadata of documents | United States | In use (Preview Environment) |
| Cloudflare, Inc. (R2 object storage) | Stores uploaded documents and the page images we render from them | Documents and rendered pages | United States, as the primary location. Placement inside Cloudflare's network is chosen by Cloudflare unless a jurisdiction is set, and we make no commitment about residency beyond this | In use (Preview Environment) |
| Resend (Resend, Inc.) | Sends transactional email: invitations, security notices and billing messages | Recipient address and message content | United States | In use (Preview Environment) |
| Upstash, Inc. | Rate limiting of sign-in and sign-up attempts, and the lock and block counters for failed sign-ins | IP address and a keyed one-way hash of the e-mail address (the address itself is never sent); no document content | United States | In use (Preview Environment) |
| Render (Render Services, Inc.) | Compute hosting for the programmes we run ourselves: the background workers that convert uploaded files to page images, draw each viewer's watermark, send notifications and run scheduled jobs, and Gotenberg, the converter that turns Office files into pages. A malware scanner is planned and not connected: we will say where it runs before it does | Documents, in transit during conversion and rendering; not kept by the worker afterwards | United States (Oregon) | Planned |
| Amazon Web Services, Inc. | Key management for signing certificates, and write-once storage for the daily seal of the audit ledger | Hash values and signature material only; no Customer Content and no personal data in readable form | United States | Planned |
3. Changes
We give at least 30 days' notice before a new or replacement sub-processor starts to process Customer Personal Data. We email the Customer's account administrators and update this page, and the date at the top shows when the list last changed. A Customer may object on reasonable data-protection grounds within that period, as section 6 of the Data Processing Addendum provides, and may end the affected Room's subscription for a pro-rata refund of its unexpired prepaid fees if we cannot resolve the objection. To be told of changes at an address that is not an account administrator's, write to hello@mandateroom.com with "Sub-processor notices" in the subject line.
4. Other recipients
Cloudflare, Inc. (Cloudflare Pages) hosts our public website. The site holds no Customer Content and no account: the host sees what any host sees of a visitor, the address and the pages requested. It is listed here, and not in section 2, because it never handles Customer Content. The private application's host is not yet chosen: it will be named in section 2, with the notice of section 3, before it processes any Customer Content.
Wise receives the payer's name, bank details, payment reference and amount when a Customer pays an invoice by bank transfer. It does not receive Customer Content. We do not receive card details.
Tally (Tally BV, Belgium; tally.so) runs the waitlist form on which a visitor asks for access. It receives only what the visitor chooses to enter in that form: name, work email address, organisation and an optional note. Tally states that it acts as our processor and stores form data in Europe. It does not receive Customer Content, and nothing from inside a Room is sent to it. It receives data from the day the waitlist link is published on our website; until then it receives nothing.