Legal
Subprocessors
Who else receives data when you use cargo protection — a draft list for counsel, not a finished register.
Draft — not reviewed by counsel. Regions marked “[Confirm]” must not be treated as a promise of EU-only processing. attachmentAV is listed for malware scans of uploads (EU). We do not list Sophos. Analytics, Matomo, Meta and LinkedIn are not in use.
Current processors
We do not sell data. The following providers receive data only as needed for their task. A fuller description is in the Privacy policy.
- Railway — Application hosting (this website and the software run here). Region: Prefer EU — confirm service region. Logs may include IP addresses and error text. DPA signed 2026-08-26.
- Supabase — Authentication, database, file storage. Region: Prefer EU — confirm project region. Account, document and report data. DPA signed 2026-08-26.
- Google Cloud Document AI — OCR of uploaded files. Region: [Processing region to confirm]. File / image of the document. DPA signed 2026-08-26.
- OpenAI (API, not ChatGPT) — Extract fields and understand email threads. Region: US; EU residency if approved still open. OCR / email text. API default = no training. DPA signed 2026-08-26.
- WhoisXML — Domain registration age. Region: US. Domain name. DPA signed 2026-08-26.
- Bouncer — Email disposable / free / role checks. Region: PL / EU. Email address (document contacts and some sign-up addresses). DPA signed 2026-08-26.
- Twilio — Phone line type (mobile / VoIP). Region: US. Phone number. DPA signed 2026-08-26.
- Resend — Invite emails and Enterprise quote messages. Region: [Confirm]. Invitee email and workspace name; quotes to info@cargo-protection.com. DPA signed 2026-08-26.
- attachmentAV — Malware scan of uploaded files. Region: EU. File bytes for detection only. We do not list Sophos (their engine). DPA confirmation still open.
- Stripe — Payments (when live). Region: Stripe Payments Europe, Dublin; US parent possible. Billing email and payment data. DPA still open before live keys.
- VIES (European Commission) — VAT exists / name. Region: EU public API. Country + VAT number. Not a commercial processor — no DPA.
Not live yet
- Sentry and website analytics — not turned on.
Not processors of customer documents: tools used only to write the software (for example editors and coding assistants).
Changes
[For counsel: process to notify customers of material subprocessor changes.] Until that process exists, this page will be updated when a provider is added or removed.