Pressfox is operated by IT Solid Solutions from Brazil (see the DPA for the safeguards on that access). Under Article 28(2) and (4) GDPR we tell you which other processors we use for Customer Data and give you a chance to object. This page is the authoritative list referenced by the data processing agreement.
Current subprocessors
| Provider | Purpose | Location | Transfer mechanism | Data |
|---|---|---|---|---|
| Railway Corp. | Application hosting, the PostgreSQL database and its backups, background workers, render plane | EU West (Amsterdam, Netherlands); company in the United States | Railway DPA with SCCs | Customer Data, account data, logs |
| Cloudflare, Inc. | DNS, TLS termination, CDN, object storage (R2) for payloads, HTML and PDFs, custom hostnames, the security check on sign-in and sign-up (Turnstile) | R2 buckets with the EU jurisdiction restriction; global edge for DNS, TLS and caching; company in the United States | Cloudflare DPA with SCCs; EU-US Data Privacy Framework | Customer Data in storage and in transit, IP addresses |
| Paddle.com Market Ltd / Paddle.com Inc. | Merchant of record: checkout, tax, invoicing, subscriptions, refunds | United Kingdom, United States | Paddle acts as an independent controller for payment data; Paddle DPA for shared account data | Billing identity, email, plan |
| Google LLC | Sign in with Google (OAuth), only when the user chooses it | United States, global | Google Cloud DPA; EU-US Data Privacy Framework | Email, name, Google account id |
| Resend, Inc. | Transactional email: sign-in codes, invitations, usage, incident and change notices | Sending region in the EU (Ireland); company in the United States | Resend DPA with SCCs | Email address, name, message content |
| Anthropic, PBC | AI text features, only when used: drafting template translations, translating report text fields marked for translation, AI summaries, the designer assistant, building a draft template from an uploaded PDF (its text). Text only, never images | United States | Anthropic commercial terms and DPA with SCCs | Template text; for report translation and summaries, the marked text fields of that report; for a template started from a PDF, that PDF's text |
| Functional Software, Inc. (Sentry) | Error and performance monitoring for the application and the render plane | EU data region (Frankfurt, Germany); company in the United States | Sentry DPA with SCCs | Request ids, stack traces, scrubbed context; no payload content |
Notice and objection
We announce additions and replacements here and by email to workspace owners at least 30 days before the change takes effect. If you have a reasonable data-protection objection, write to hello@pressfox.io, subject "Subprocessor objection", within that period. We will try to resolve it; if we cannot, you may terminate the affected service and we refund prepaid, unused fees.
Flow-down
Each subprocessor is bound by a written agreement imposing data protection obligations at least as protective as our DPA. We remain fully liable to you for their performance.
Change log
| Date | Change |
|---|---|
| 13 October 2026 | Railway's purpose names the database backups it holds. No provider added or removed. |
| 10 October 2026 | Removed Amazon Web Services (Amazon Bedrock): the AI text features use Anthropic in the United States for every workspace. Resend's sending region set to the EU (Ireland). Transfer mechanisms restated as the providers' DPAs give them. |
| 9 October 2026 | Added Anthropic and Amazon Web Services (Amazon Bedrock, EU region) for the optional AI text features. Nothing is sent to them unless a workspace uses those features; health workspaces cannot. |
| 7 October 2026 | Initial list published. |