Subprocessors
Version 2026-06-22 · Last updated June 22, 2026
Crossaryuses a small set of third-party service providers (“subprocessors”) to deliver the product. Each processes data only as needed for its function and under its own data-protection terms. We keep this list current; the table below reflects our subprocessors as of the date above.
1. Current subprocessors
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | AI inference — field extraction & mapping suggestions. Prompts (which may include uploaded spec content) may be retained by OpenAI for a limited period (up to ~30 days) for abuse monitoring, then deleted; API data is not used to train shared models. Deleting an integration in Crossary does not purge any copy already processed by OpenAI. | United States |
| Cloudflare (R2) | Object storage for uploaded artifacts & exports | European Union |
| Render | Application hosting & managed PostgreSQL database | Frankfurt, EU |
| Stripe | Payment processing & subscription billing | United States |
| Purelymail | Transactional email delivery (SMTP) | United States |
| Sentry | Application error monitoring | United States (EU data residency available) |
| PostHog (EU Cloud) | Product analytics — cookieless pageviews & product events (no cookies, no advertising, no cross-site tracking) | European Union (Frankfurt) |
2. International transfers
Where a subprocessor processes personal data outside the European Economic Area (for example, providers located in the United States), that transfer is covered by an appropriate safeguard such as the EU Standard Contractual Clauses or an adequacy mechanism. Customer artifacts and the primary database are hosted in the EU (Frankfurt); AI inference and payment processing are performed by providers that may operate in the United States. See the Privacy Policy for details.
3. Changes and notification
When we add or replace a subprocessor that processes customer personal data, we will update this page. Customers with a Data Processing Addendum may object on reasonable data-protection grounds as set out in the DPA.
4. Contact
Questions about our subprocessors: support@crossary.com.