Full subprocessor list
We now publish our complete list of subprocessors — all fourteen — and announce changes to it here. Two are new this update: Axiom and Better Stack.
Every provider that processes data on our behalf is listed at codeqr.io/legal/subprocessors, with the purpose, the data involved, and where it is processed. That page has always existed. What changes today is that we announce it — and any future change to it — here in the changelog, as our Data Processing Agreement commits us to.
Infrastructure
- Vercel — hosting, CDN and edge network. All service data in transit. United States (global edge).
- PlanetScale — primary database. Account, workspace, link/QR metadata, leads. United States.
- Upstash — cache and message queue. Link/QR lookup data, job payloads. United States.
- Tinybird — event analytics processing. Click and scan events, pseudonymized. European Union.
- Cloudinary — image storage and processing. QR images and uploaded media. United States.
Running the service
- Stripe — payment processing. Billing and payment data. United States.
- Resend — transactional email. Name and email address. United States.
- Anthropic — AI features. Content you submit to an AI feature. United States.
- Statsig — feature flags and experimentation. Feature usage data. United States.
Operations — new in this update
- Axiom — application logging and observability. Request metadata and application logs, including the IP address of the requesting client. United States.
- Better Stack — uptime monitoring, our public status page, and incident records. Uptime probe results and incident notes. European Union.
Marketing site only, and only with your consent
- Google (Analytics / Tag Manager) — marketing-site analytics. United States.
- Meta (Pixel) — marketing-site advertising measurement. United States.
- AdOpt — consent management. Consent records. Brazil.
These three run on our marketing site behind the consent banner. They are not used inside the app.
Retention and transfers
Application logs are kept for 30 days and are used to investigate security incidents, abuse, and service faults. Where a provider processes data outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses incorporated into our Data Processing Agreement.
Adding Axiom and Better Stack introduced no new category of personal data beyond the request IP address noted above, and no action is required from you.