Subprocessors
Version 1.2 · 2026-08-25 · Current development inventory. Production regions and contractual safeguards require release evidence before live processing.
| Subprocessor | Purpose | Region | Safeguard |
| Neon (Postgres) | Primary database | Current development project: US (`aws-us-east-1`) | DPA + SCCs (EU Standard Contractual Clauses); production project/region must be recorded before approval |
| Vercel | Application hosting | Production function region not yet evidenced in this draft | DPA/SCC and actual deployment-region evidence required before approval |
| Stripe | Payment processing on the campground's own account | EU entity | Stripe DPA (the campground is Stripe's customer) |
| Mollie | Payment processing on the campground's own account | NL | Mollie DPA (the campground is Mollie's customer) |
| Resend | Transactional email delivery | Provider is US-based; actual sending/data-processing region not yet evidenced in this draft | DPA + SCCs; record configured region before approval |
Bird/MessageBird is planned but not an active subprocessor until a campground enables messaging and the account, region, DPA and transfer basis are recorded.
Statutory recipients (police/statistics/tax authorities under national law, e.g. Alloggiati Web, eVisitor, SES.Hospedajes) are not subprocessors — they are independent controllers receiving data under a legal obligation.
The executed DPA must state the notification period and objection process. The older blanket 30-day promise is not repeated here without that executed term.