Subprocessor List
Last updated: 2026-05-10
This is the list of third-party services FabWise uses to host, deliver, support, or protect the product. When a subprocessor is added, removed, or materially changes, we update this page and notify subscribed customers where feasible.
To subscribe to subprocessor change notices, email privacy@fabwise.app.
Active subprocessors
| Vendor | Role | Data processed | Region | Security posture |
|---|---|---|---|---|
| Render | Application hosting + PostgreSQL database | Customer account data, users, time records, jobs, customers, operational records, audit logs, and sessions | Oregon (US-West) | SOC 2 Type II attested; Render's posture: https://render.com/security |
| Stripe | Payment processing + subscription management | Billing contact (name, email, address), payment method tokens (cards never stored on FabWise), subscription history, invoice records, webhook events | US (Stripe Inc., Delaware) | PCI DSS Level 1; SOC 1 + SOC 2 attested; Stripe's posture: https://stripe.com/docs/security |
| Pure Inference Ventures (Postal) | Email delivery | Recipient email addresses and email content for transactional, account, billing, and product communications | US | Self-hosted Postal infrastructure managed by Pure Inference Ventures |
| Google Cloud Platform | Object storage for database backups | Encrypted production database backups | US | SOC 1 + SOC 2 + ISO 27001/27017/27018 attested; GCP's posture: https://cloud.google.com/security |
| Cloudflare | CDN / edge proxy + access controls for supporting infrastructure | HTTP request metadata and traffic routed through Cloudflare services | Global edge | SOC 2 Type II + ISO 27001 attested; Cloudflare's posture: https://www.cloudflare.com/trust-hub/ |
| Apple Push Notification Service | iOS push notification delivery | Notification payloads for supervisor mobile workflows | US | Apple's enterprise posture documented at https://www.apple.com/legal/privacy/ |
| Sentry | Application error tracking | Error reports, stack traces, request paths, and diagnostic context needed to investigate production errors | US (Sentry Inc., San Francisco) | SOC 2 Type II attested; Sentry's posture: https://sentry.io/security/ |
| Anthropic | AI-assisted support and engineering workflows | Limited customer context only when manually provided for support, debugging, or product development; no direct production database access | US | Anthropic's trust posture: https://trust.anthropic.com/ |
Notification Policy
When a subprocessor is added, removed, or has its scope materially changed, FabWise notifies subscribed customers via email at least 30 days before the change takes effect, where feasible. Customers can subscribe by emailing privacy@fabwise.app.