Subprocessors
Effective date:
We keep the list of subprocessors deliberately small. Each provider is bound by a data processing agreement and, where data leaves the EEA/UK, by appropriate transfer safeguards.
1. Current subprocessors
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, CDN, object storage, queues | Global edge network | DPA; EU SCCs; regional data residency options |
| Stripe, Inc. | Payment processing, tax, invoicing, fraud prevention | Global Tier-1 hubs | PCI-DSS Level 1; DPA; EU SCCs |
| Resend, Inc. | Transactional email delivery | United States | DPA; EU SCCs |
| DeepSeek | Optional AI features (summarisation / translation / chat) | China (mainland) — cross-border transfer | Server-side proxy only; invoked only when AI features are used; no API key exposed to browsers; transfer under SCCs / your instructions |
Payments are processed by Stripe; we never receive or store full card numbers. AI providers are invoked only for the specific AI feature you request and are contractually instructed not to use submitted content for model training; AI features can be disabled on request for business plans.
2. Changes & objections
We will update this page before adding or replacing a subprocessor that processes personal data. Business customers may subscribe to subprocessor change notices and, where the executed DPA provides for it, object to a new subprocessor.
3. Contact
Privacy and DPA enquiries: privacy@pdflean.com or dpo@pdflean.com. See also our Data Processing Addendum and Privacy Policy.