Sub-Processor Registry
Last updated: November 2026
Sporeline engages the following third-party sub-processors to deliver the Service. All sub-processors are contractually bound to process data only as instructed and are prohibited from attempting to re-identify any individual or Customer from data they process.
| Sub-Processor | Purpose | Data Categories | Country | Last Review |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — compute, storage, database, networking | All Customer Data | United States | Mar 2026 |
| Stripe | Payment processing — subscription billing, invoicing | Billing and payment data | United States | Mar 2026 |
| Amazon Simple Email Service (SES) | Email delivery — transactional and notification emails | Email addresses, notification content | United States | Mar 2026 |
| PostHog | Product analytics and session replay (typed input masked; on-screen text visible) | Pseudonymous user ID, tenant ID, role and plan; in-app usage events; session recordings of the signed-in app, with typed input masked and on-screen text visible. | United States | Nov 2026 |
| Linear | Issue tracking — in-app feedback you send becomes an issue we work from | The text of the feedback you send, your farm name, your pseudonymous user ID and role, the page address, recent page addresses, and trimmed browser errors. Never your account email address or name: email-shaped text is stripped. A note or farm name you type is sent as typed, so it can hold anything you write in it. | United States | Nov 2026 |
| Anthropic (Claude), including through Amazon Bedrock | Diagnosing errors and writing the ops triage summaries that file our issues | Redacted error details, alarm text and log excerpts (email addresses and access tokens removed) and Sporeline's own code; never your farm records | United States | Nov 2026 |
| Checkly | Automated checks that our sign-in and main pages keep working | Screenshots and results of test pages from a synthetic test farm. No customer data: the checks never sign in to a customer farm. | Germany and United States | Nov 2026 |
| Microsoft Azure | Hosting, only for customers who run Sporeline in their own Azure subscription | That customer's own Customer Data, in their subscription. Not used for any other customer. | The Azure region the customer chooses | Nov 2026 |
| QuickBooks Online (Intuit) — only if you connect it | Accounting sync, when a farm connects its own QuickBooks company | The customers, products, invoices and payments that farm chooses to sync. | United States | Nov 2026 |
| Shopify — only if you connect it | Online store sync, when a farm connects its own Shopify store | The products, inventory and orders that farm chooses to sync. | Canada and United States | Nov 2026 |
Two tools never receive customer data. OpenAI Codex reviews Sporeline's own code and infrastructure only, and GitHub holds that code.
Analytics Processing
The signed-in app uses PostHog for product analytics and session replay (typed input masked; on-screen text visible). PostHog session replays mask typed input and show on-screen text, such as block IDs, names and numbers on the page. On public pages (website, sign-in, sign-up, docs) PostHog receives only a few steps, such as a page opened or the sign-up form sent, with no recording, under one first-party analytics cookie that holds a random visitor id (in the EU, EEA, UK and Switzerland only after the visitor accepts it); the Privacy Policy, Section 10, lists each one.
Change Notifications
We notify all Customers at least 30 days before a new sub-processor begins processing data. You may object to a new sub-processor within 15 days of notification. If we cannot accommodate your objection, you may terminate your subscription without penalty.
To receive sub-processor change notifications, enable "Sub-Processor Alerts" in Settings > Privacy > Sub-Processors.
Change Log
Corrected the PostHog entry: session replays mask what you type but show on-screen text. Named Amazon Bedrock as a route to Anthropic Claude, which also writes the ops triage summaries that file our issues
November 9, 2026
Listed every service that receives customer data: Linear (in-app feedback), Anthropic Claude (error diagnosis), Checkly (checks on a synthetic test farm), Microsoft Azure (only for customers who run Sporeline in their own Azure), and QuickBooks Online and Shopify (only if a farm connects them)
November 6, 2026
Added PostHog for product analytics and session replay
October 7, 2026
Added Stripe for payment processing
September 1, 2025
Initial sub-processor list: AWS, Amazon SES
June 1, 2025
Objection Process
If you object to a new sub-processor, you may submit an objection through Settings > Privacy > Sub-Processors or by emailing chase@sporeline.com.
Sporeline has 15 days to respond with either: (a) confirmation that your data will not be processed by the new sub-processor, or (b) an explanation of why the sub-processor is necessary, along with your right to terminate without penalty.