Skip to content

Subprocessors

Every company involved in running Typoza, what is transmitted to it, where it hosts, and on what legal basis.

Last updated: October 14, 2026 — This date is derived from our list of subprocessors. It changes as soon as that list changes.

This page translates the French original, which is the version that prevails in case of difference.

The list

  • Vercel

    Hosting

    Data transmitted
    • The IP address and user-agent header of every request, in the access logs
    • The content served: the marketing site, the documentation, the application's screens, the public API, the MCP server and the workspaces' sites
    • The projects' environment variables, including the keys of the other third parties
    • The domain names workspaces connect, in order to serve them and issue them a certificate
    • When a form is sent — signing up or in, subscribing, commenting, contacting, reporting: signals from the browser, which Vercel BotID checks to turn away robots that pose as people; its deep analysis, when switched on, is run by Kasada, a Vercel subprocessor in the United States. Nothing is shown, and no profile is kept
    Hosting
    United States (Vercel Inc.), delivered through a worldwide network of points of presence; functions run in Paris (cdg1), next to the database, except those of the marketing site and the documentation — sign-in and help forms included —, which run in the region closest to the visitor: Paris (cdg1), Washington (iad1), Portland (pdx1), Singapore (sin1) or Sydney (syd1)
    Legal basis
    Performance of the contract
    Where it operates
    Our servers · The application · The Typoza site · A workspace's public site
    Legal entity
    Vercel Inc.

    Read the policy

  • Prisma Postgres

    Database

    Data transmitted
    • Accounts: name, email address, hashed password, sessions
    • Workspaces, their members and their settings
    • Posts, pages, drafts and versions — every text, in full
    • Newsletter subscribers, conversations with readers and the activity log
    • Readers' reactions, comments and reports, with the address they confirmed or left
    • Reading statistics, with no reader identifier
    Hosting
    ** to be confirmed ** — region chosen when the production and staging databases were created
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    Prisma Data, Inc.

    Read the policy

  • Vercel Blob

    File storage

    Data transmitted
    • Files uploaded to a workspace: images, and their resized variants
    • Attachments to conversations with readers, in a private store
    • Workspace backups, encrypted, in the same private store: the content, the members with their email address, and — if the owner ticked the box — the newsletter subscribers with theirs
    • Screenshots attached to help requests, in the same private store, re-encoded without their metadata
    • Typoza's invoices and credit notes, as PDF, in the same private store: the buyer's name, postal address, email address and tax number, kept ten years
    Hosting
    United States (Vercel Inc.). Region of the stores: ** to be confirmed **
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    Vercel Inc.

    Read the policy

  • Vercel Sandbox

    Nightly backup

    Data transmitted
    • Every night, for the length of the backup: a copy of the whole database — accounts, texts, subscribers, statistics — read on a machine Vercel creates for the run, encrypted on it, then restored on a throwaway database on the same machine to prove that it can be
    • The files of the two stores, copied the same night: the images as they are, the private files encrypted on the machine
    • These copies, kept six months at most on a Vercel disk that only the backup mounts and no application can read: the database encrypted, the private files encrypted, the images as they are
    • Nothing else is kept once the run is over: the machine is discarded without any snapshot of its own disk, and its log holds counts, never data
    Hosting
    United States (Vercel Inc.); the machine and the backup disk are in Paris (cdg1), next to the database
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    Vercel Inc.

    Read the policy

  • Vercel Analytics

    Analytics

    Data transmitted
    • Timestamp, URL and dynamic path of the page viewed
    • Referrer and filtered query parameters
    • Country, region and city inferred from the IP address
    • Operating system and version, browser and version, device type, script version
    Hosting
    United States (Vercel Inc.)
    Legal basis
    Legitimate interest
    Where it operates
    The application · The Typoza site
    Legal entity
    Vercel Inc.

    Read the policy

  • Vercel Speed Insights

    Analytics

    Data transmitted
    • Route and URL of the page measured
    • Network speed as declared by the browser (4g, slow-2g…)
    • Browser, device type, operating system, two-letter country
    • The performance measurement and the selector of the element it refers to
    Hosting
    United States (Vercel Inc.)
    Legal basis
    Legitimate interest
    Where it operates
    The application · The Typoza site
    Legal entity
    Vercel Inc.

    Read the policy

  • Upstash

    Rate limiting and shared cache

    Data transmitted
    • Rate-limit counters: an account's internal identifier, the IP address of whoever fills in a public form, or a fingerprint (SHA-256) of an email address, never the address itself — and the number of attempts in the current window
    • The public map of workspaces, kept for a few minutes: slug, verified domains, theme, published addresses
    • No post text, no message, no email address
    Hosting
    ** to be confirmed ** — region chosen when the Upstash database was created
    Legal basis
    Legitimate interest
    Where it operates
    Our servers
    Legal entity
    Upstash, Inc.

    Read the policy

  • Better Stack

    Status page and uptime checks

    Data transmitted
    • The status page, status.typoza.com, which Better Stack serves: like any website, it sees the IP address and the browser of whoever opens it
    • Its probes open Typoza's public pages from outside, like a visitor without an account: nothing personal goes either way
    • Every hour, a call from our servers saying the health checks ran, and nothing else
    Hosting
    Mostly the European Union (Better Stack, Inc., United States)
    Legal basis
    Legitimate interest
    Where it operates
    Our servers
    Legal entity
    Better Stack, Inc.

    Read the policy

  • Resend

    Email delivery and receiving

    Data transmitted
    • The recipient's email address and name
    • The content of the message sent: address verification, invitation, quota alert
    • The content of a workspace's newsletter: the titles, excerpts and links of its posts
    • The delivery status: sent, delivered, rejected, delayed, marked as spam
    • Mail received at our addresses: sender, subject, message body and the details of its attachments
    • What a reader writes under a post: the link that confirms their reaction or comment, the reply notice they asked for, and the passage both of them quote
    • The moderation of a comment: the reason for a refusal or a removal, with the comment quoted, to its author; the acknowledgement and the decision on a report, to the reader who left their address
    • The founder's onboarding emails: the first name, a workspace name, a draft title, a domain name or a subscriber count, depending on the email; and the replies sent to him
    • A help request to the Typoza team: its acknowledgement, to the address that wrote it, and the whole request with its context, to the team
    • The monthly revenue statement, to the founder and the team's accountants: the month's totals, with the receipts book attached — each payment and refund with its date, amount and invoice number, and the customer's name (or, failing that, their email address)
    Hosting
    Ireland (region eu-west-1); Resend, Inc. is an American company
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    Resend, Inc.

    Read the policy

  • Stripe

    Payment

    Data transmitted
    • The account holder's email address and name
    • Payment details, entered at Stripe and never received by Typoza
    • The billing address and country, to calculate tax
    • The history of subscriptions, invoices and refunds
    Hosting
    Ireland and the United States
    Legal basis
    Performance of the contract
    Where it operates
    Our servers · The application
    Legal entity
    Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States)

    Read the policy

  • Anthropic

    Writing assistance

    Data transmitted
    • Depending on the function called from the editor, and nothing else: the passage to rewrite; the last four hundred words before the cursor, for completion; a post's title and its first five hundred words, for the title and summary suggestion
    • For an image's alternative text: the image, and its caption if you wrote one
    • The writing instruction chosen
    • For the summary of a week flagged by abuse detection, requested and paid for by the Typoza team: the week's counts, with no text and no name
    • For TypozAI, the help robot, asked from the dashboard or the storefront: the question, the earlier questions and answers of the same conversation (six at most), the documentation pages that match, and, from the dashboard, the screen and the workspace's plan
    • No account identifier, no name, no email address
    Hosting
    United States (Anthropic, PBC)
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    Anthropic, PBC

    Read the policy

  • GitHub

    Third-party sign-in

    Data transmitted
    • At sign-in: the GitHub account's public name, email address and avatar URL
    • The browser's IP address, as it reaches GitHub to display the avatar
    • No text, no workspace content
    Hosting
    United States (GitHub, Inc.)
    Legal basis
    Consent
    Where it operates
    Our servers · The application
    Legal entity
    GitHub, Inc. (Microsoft group)

    Read the policy

  • Geoapify

    Mapping

    Data transmitted
    • The postal address of a workspace's registered office, when its owner saves it
    • The resulting coordinates, to request the map image
    • Our servers' IP address, never a reader's
    • No reader data: the image is served from our storage
    Hosting
    European Union — Hetzner data centres, Bunny CDN distribution for .eu calls; a company governed by Cypriot law
    Legal basis
    Performance of the contract
    Where it operates
    Our servers
    Legal entity
    KEPTAGO LTD, Paphos, Cyprus

    Read the policy

  • Have I Been Pwned

    Breached-password check

    Data transmitted
    • The first five characters of a password's SHA-1 hash, at sign-up and when a password is changed
    • Nothing else: not the password, not its full hash, not an email address, not an account identifier
    • The call leaves from our server, never from the browser: the IP address transmitted is ours
    Hosting
    Served by the Cloudflare network — the answer comes from a cache, observed in Frankfurt on 18 September 2026. The corpus itself is stored on Microsoft Azure, western United States
    Legal basis
    Legitimate interest
    Where it operates
    Our servers
    Legal entity
    Superlative Enterprises Pty Ltd (ABN 62 085 442 020), Australia

    Read the policy

  • Firebase Cloud Messaging

    Device notifications

    Data transmitted
    • The subscription address Chrome assigned to the device, which identifies that device to Google
    • The encrypted message, which Google carries without being able to read it: neither the title, nor the sentence, nor the link is readable to it
    • Our server's IP address, and the date of each send
    Hosting
    United States (Google LLC), worldwide infrastructure
    Legal basis
    Consent
    Where it operates
    Our servers
    Legal entity
    Google LLC

    Read the policy

  • Mozilla Push Service

    Device notifications

    Data transmitted
    • The subscription address Firefox assigned to the device
    • The encrypted message, carried without being readable
    • Our server's IP address, and the date of each send
    Hosting
    United States (Mozilla Corporation)
    Legal basis
    Consent
    Where it operates
    Our servers
    Legal entity
    Mozilla Corporation

    Read the policy

  • Apple Push Notification service

    Device notifications

    Data transmitted
    • The subscription address Safari assigned to the device
    • The encrypted message, carried without being readable
    • Our server's IP address, and the date of each send
    Hosting
    United States (Apple Inc.), worldwide infrastructure
    Legal basis
    Consent
    Where it operates
    Our servers
    Legal entity
    Apple Inc.

    Read the policy

  • Windows Push Notification Services

    Device notifications

    Data transmitted
    • The subscription address Microsoft Edge assigned to the device
    • The encrypted message, carried without being readable
    • Our server's IP address, and the date of each send
    Hosting
    United States (Microsoft Corporation), worldwide infrastructure
    Legal basis
    Consent
    Where it operates
    Our servers
    Legal entity
    Microsoft Corporation

    Read the policy

What does not touch your readers

The “where it operates” column is not decorative. A reader's browser on your workspace's site talks to one company only, Vercel: to its hosting, which serves the pages, and to its storage, which serves the images. The two measurement tools in this table appear only on the Typoza site, its documentation and the application; on your site, the only measurement is ours, without a cookie.

That boundary is enforced by code, not by instruction: a test refuses any subprocessor on a public page other than the host or a file store, another reads the project tree and refuses a measurement tool mounted there, and a browser test fails as soon as a public page calls an outside address.

The map on your contact page is where that boundary was decided rather than observed. A sliding map would have had every one of your readers' browsers fetch its base tiles, and so hand their IP address to a mapping provider, on a page that is yours. The image is therefore rendered once, on our side, when you save your address; your readers receive an image file, like a photograph in an article. The mapping provider sees only your registered office's address — the one you have just chosen to publish.

Beyond Vercel, Prisma Postgres and Upstash, which keep for us what we keep, one exception, and only one: our delivery provider. If your workspace offers a newsletter, the people who subscribe entrust their address to it, since it has to know it in order to deliver; so does a reader who reacts or comments, one who reports a comment and leaves an address, and anyone who writes to you from your contact page. It is the only other subprocessor your readers touch, it touches them only if they asked, and it receives nothing beyond what is needed to carry the mail.

Four services we do not choose

Google, Mozilla, Apple and Microsoft appear in this table for device notifications. They are the only ones we did not choose: your browser designates its own, and we have neither the means nor the wish to impose another on you.

None of the four is contacted until you have switched on notifications for a device. And when they are, they carry without reading: a notification's text is encrypted with a key only your device holds. They receive a subscription address, a date and our server's address — never what is written.

How this page stays true

This list is not written into the page. It is written once, in the product's code, and the page displays it. Two lists always diverge, and the one nobody re-reads is the one that stays online.

  • A dependency added to the product must be attached to a subprocessor, or declared to make no outbound call. Otherwise the automatic check fails and the release does not reach production.
  • An outside server allowed to receive anything at all from your browser must match a row in this table. Otherwise, the same refusal.
  • A new sign-in method — signing in with a third-party account — must have its row before being switched on. Otherwise, the same refusal.
  • The update date shown at the top of the page is derived from this table: nobody types it, so nobody can forget to change it.
  • This check has two limits, and hiding them would be dishonest: it sees neither a service whose address is known only at the moment of the call, nor a call our servers make without a dependency of its own. The four notification services are in the first case — it is your browser that supplies the address; the mapping provider, the breached-password check and the VAT-number check are in the second. They are entered here by hand, and a human review answers for them.

What is not here, and why

Services whose content you embed in a post — a video, a public message — are not our subprocessors: you choose them, post by post. Privacy explains what they see of your readers.

Every company in the table above has a hosting region. Until it has been verified, the table says “to be confirmed” rather than giving a plausible answer.