Updated 29 October 2026
Service providers and subprocessors.
This is the current technical service inventory. Roles, contractual entities, transfer arrangements and authorisation for processing subscriber data must be settled in the production data-processing agreement. This list is not a claim that those arrangements are complete.
| Provider / status | Purpose and data | Configuration and limits |
|---|---|---|
| VercelActive | Application hosting and request handling Application requests, workspace data processed by server functions, technical request metadata | Application functions configured for London. This is not a guarantee that all vendor processing is UK-only. |
| Neon / Neon AuthActive | Database and workspace authentication Workspace/profile details, authentication data, encrypted subscriber addresses and manual API keys, subscription references and notice records | Application database configured in London. Authentication is provided through Neon Auth. |
| Cloudflare R2Active | Private audit-pack storage Exported notice records, timestamps, content and pseudonymous subscriber references; notice text can contain personal data | Bucket configured with EU jurisdiction restriction. R2 stores files; it does not send notices. |
| StripeActive integration | Subscription events, connected merchant operations and Durably billing Merchant account references, subscription/payment metadata and billing customer details | Stripe's role depends on the service and processing activity; not every Stripe activity is processing solely on our instructions. Card details are not stored by Durably. |
| Cloudflare Email Service / Workers / Durable ObjectsActive | Subscription notice delivery and duplicate prevention Recipient and reply-to addresses, sender, notice content, content hash and provider message reference | Email Service sends notices from notices@asppectlabs.com. A private Worker handles delivery; Durable Objects persist the content hash and provider receipt to prevent duplicates. This service has no UK-only processing restriction configured. |
International processing
The service operator is based in Brazil. A London database or EU storage bucket alone does not establish that processing or support access is restricted to the UK. Applicable international-transfer and processor arrangements require review before production onboarding.
See data-processing agreement status and the privacy notice. Questions about providers or changes can be sent to the contact below.
Service operator
Durably is a product by Asppect Labs, operated by ASPPECT DESIGN LTDA, a Brazilian company registered under CNPJ 47.415.689/0001-89.
Rua Conquista, 252, Bairro Fátima, Uberlândia, MG, 38400-482, Brazil.
Support and privacy enquiries: contato@asppect.com.br.