Subprocessors
Last updated 2026-11-13. QuantumRepair uses the following third-party processors to deliver the service. We’ll post changes here at least 30 days before they take effect — sign up for an RSS feed by emailing legal@quantumrepair.app.
| Processor | Purpose | Location | Data | Contract |
|---|---|---|---|---|
| Vercel | Application hosting (web app, API, serverless functions) + CDN | Global edge; functions in Frankfurt (EU) | All requests to the platform, including shop and customer data in transit | Vercel DPA |
| Railway | Primary database (PostgreSQL), queue/cache (Redis) and background worker | US (us-west2) | All shop data and shop-customer PII at rest; queue payloads | Railway DPA |
| Hetzner Online | Infrastructure for our self-operated S3-compatible file storage | Germany (Nuremberg) | Uploaded files: ticket photos, documents, images | Hetzner data processing agreement (AVV) |
| Backblaze | Encrypted off-site database backups (B2) | EU (eu-central-003) | Database backups, encrypted before upload (age) | Backblaze DPA |
| Cloudflare | DNS; encrypted off-site database backups (R2) | Global | DNS queries; database backups, encrypted before upload (age) | Cloudflare DPA |
| Stripe | Subscription billing for QuantumRepair; card payments for shops through Stripe Connect (each shop's own connected Stripe account) | US + EU regions | Billing details; card data is entered with Stripe directly and never stored by us | Stripe DPA + SCC |
| Resend | Transactional + marketing email (primary) | US | Email addresses, message bodies | Resend DPA |
| Postmark (ActiveCampaign) | Transactional email (fallback) | US | Email addresses, message bodies | Postmark DPA |
| Telnyx | SMS + phone numbers (US) | US | Phone numbers, message bodies | Telnyx DPA |
| Twilio | SMS + MMS + dedicated phone numbers | US, with EU data residency option | Phone numbers, message bodies | Twilio DPA |
| OpenAI | AI for diagnostics, chat, copywriting and forecasting (primary AI provider) | US | Prompt content (redacted where PII is involved); API data is not used for training | OpenAI DPA |
| Anthropic | AI for the same features (secondary provider, only when enabled) | US | Prompt content (redacted where PII is involved), zero training rights by contract | Anthropic commercial terms |
| WorkOS | Single sign-on (SSO) for team logins | US | Staff names, email addresses, identity-provider attributes | WorkOS DPA |
| Google (Places API) | Address autocomplete | US | Partial address text typed into address fields | Google Maps Platform terms + data processing terms |
| Sentry (Functional Software) | Error monitoring + performance | EU (Germany) | Stack traces, breadcrumbs (no request bodies by default) | Sentry DPA + SCC |
Objecting to a new subprocessor
Customers on an annual or lifetime plan who object to a new subprocessor within 30 days of posting may terminate the affected service for a pro-rata refund — contact us at legal@quantumrepair.app.