Subprocessors
Last updated: 1 December 2025
Novantra engages a small set of vetted subprocessors to operate the Managed Cloud service and the Novantra website. This page lists those subprocessors, the processing they perform on our behalf, and the location where the processing takes place. The list is maintained as part of our Data Processing Agreement obligations and updated when the list changes.
A subprocessor is a third party we use to deliver a specific part of the Service (for example, database hosting, transactional email, or bot defence). Each subprocessor is bound by contractual obligations including data-protection terms. We distinguish below between subprocessors that process Customer Data inside the Managed Cloud workspace, and those that process data submitted on the Novantra website (the waitlist signup and contact form).
Cloud workspace (Managed Cloud) infrastructure. These subprocessors process Customer Data inside the Managed Cloud service at cloud.novantra.io.
| Subprocessor | Purpose | Processing location | Status |
|---|---|---|---|
| Amazon Web Services (EC2) | Compute hosting for the cloud workspace application; customer workloads execute on EC2 instances managed by Novantra. | eu-central-1 (Frankfurt) | Active |
| Amazon Web Services (SES) | Transactional email dispatch from the cloud workspace (member invitations, password reset, governance-workflow notifications). | eu-central-1 (Frankfurt) | Active |
| Neon | Managed PostgreSQL hosting for the cloud workspace database-per-organisation surfaces and for the marketing waitlist and contact-request tables. | eu-central-1 (AWS Frankfurt) | Active |
| AWS KMS + AWS S3 | Used only when a customer enables BYO Key management or BYO Storage. The key wrap and object store run inside the customer’s own AWS account and chosen region. The customer’s entitlement (cloud.byok, cloud.byo_storage) gates this flow. | Customer-selected AWS region | Optional, per customer entitlement |
| Azure Key Vault | Alternative customer-controlled key provider for BYO Key management; runs inside the customer’s Azure subscription and chosen region. | Customer-selected Azure region | Optional, per customer entitlement |
| Stripe | Billing event ingestion. We receive webhook events about subscriptions, invoices, and payment status. We do not collect card data from our app. | United States, with EU data plane | Active for Managed Cloud customers with paid subscriptions |
Marketing surface (novantra.io) infrastructure. These subprocessors process data submitted on the Novantra website — primarily the waitlist signup and contact-form flows.
| Subprocessor | Purpose | Processing location | Status |
|---|---|---|---|
| Upstash | Redis REST cache for rate-limit blind-index keys; the keys are HMAC-derived so no plaintext email is stored in the cache. | eu-west-1 (Frankfurt) | Active |
| Cloudflare | Turnstile bot-defence widget on the signup and contact forms; verifies that the submitter is a human rather than an automated agent. | Global (anycast edge) | Active |
| Zoho (ZeptoMail) | Transactional email for waitlist acknowledgement and contact-form notification. Separate from the cloud workspace’s SES dispatch. | EU region | Active |
| OAuth identity provider. Only used when a visitor chooses to sign up using their Google account; we receive the minimal profile we ask for at sign-in (email and display name). | United States (Google Cloud) | Active when used | |
| GitHub | OAuth identity provider. Only used when a visitor chooses to sign up using their GitHub account; same minimal-profile scope as Google. | United States (Microsoft Azure) | Active when used |
When we add, replace, or remove a subprocessor that handles Customer Data, we publish the change to this page and notify customers of the Managed Cloud service by email at least 30 days before the new subprocessor begins handling Customer Data. Customers may object to a new subprocessor in line with their Data Processing Agreement by writing to privacy@novantra.io within that 30-day window.
Questions about subprocessors may be sent to privacy@novantra.io.
For privacy enquiries, please email privacy@novantra.io.