Sub-processors
Last updated:
These are the third parties Cavas engages to process personal data on behalf of our customers, as referenced in section 4 of the Data Processing Agreement. We give 30 days' notice before adding or replacing any of them.
Current sub-processors
Control-plane hosting: the database and application servers that store your account, server, and site configuration.
Subscription billing and card processing. Card numbers go directly to Stripe and are never stored by us.
Transactional email: verification, password reset, and notification messages. Receives your email address and the message content.
Product analytics, error diagnostics and feature-flag evaluation, served from eu.i.posthog.com through a relay at provisore.com/ingest. Receives, from your browser: the pages you open and a fixed list of product actions you take. By default these are anonymous: no identifier is stored on your device and no profile is created. If you consent to linking them to your account, it also receives your name, email address, and the name and plan of your team. Also receives events from our own servers for the things your browser cannot see, such as a deploy triggered by a push to your repository and changes to your subscription; those are attributed to your team rather than to you. No session recording, no autocapture, and your IP address is discarded once your country has been derived from it.
Crash and error diagnostics, served from de.sentry.io. Receives an error report only when something fails in your browser: the message, the stack trace, the page path, your browser version and your IP address. Request and response bodies, authorisation and cookie headers, and URL query strings are redacted before the report leaves your browser. Session replay is not enabled, so nothing on your screen is recorded.
Transfers outside the EU/EEA
Where a sub-processor processes data outside the EU/EEA, the transfer is covered by the European Commission's Standard Contractual Clauses.
Not sub-processors
Your own infrastructure providers, the servers you connect to Provisore, are not our sub-processors. You contract with them directly; we only act on them at your instruction over SSH.
Objections
To object to a new sub-processor, or to be notified of changes to this list, email privacy@cavas.dk.