Legal
Subprocessors
Last updated
About this list
Farshore Labs uses a small set of vetted third parties (“subprocessors”) to operate the platform. Each subprocessor is bound by a written agreement that incorporates the obligations of Article 28 GDPR (or local equivalents), restricts use of customer data to the documented purpose, and requires appropriate technical and organisational measures.
This page is the authoritative list of subprocessors. We update it whenever the list changes. Customers on the email update list will receive at least thirty (30) days’ notice before a new subprocessor is added, during which they may object in writing.
Current subprocessors
| Subprocessor | Purpose | Location | Data categories |
|---|---|---|---|
| Microsoft Corporation — Azure | Application and database hosting (Azure Container Apps, Azure Cosmos DB, Azure Key Vault, Azure Container Registry, Log Analytics). | United States; primary region eastus2, DR region westus3. | All customer data at rest and in transit on the platform. |
| Stripe, Inc. | Payment processing, Setup Intent flows, subscription billing, fraud detection. | United States (with EU/UK regional processing where available). | Billing identity (name, email, country), card details (captured directly by Stripe Elements), subscription state. |
| Microsoft Corporation — Azure Communication Services | Transactional email delivery (verification, password reset, billing receipts) via the linked CustomerManaged farshorelabs.com sender domain. | United States (data location: United States). | Email address, message body for transactional mail. |
| GitHub, Inc. | Source code hosting, CI/CD, container image builds and pushes via OIDC federation to Azure. | United States. | Operational metadata only (commit author email for code committers — not customer data). |
International transfers
Transfers of personal data from the EEA, UK, or Switzerland to the United States are protected by the Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU-U.S. Data Privacy Framework. Customer-managed encryption keys remain in the operator’s region; subprocessors cannot read customer data at rest without re-authenticating to Azure Key Vault under our identity.
Objecting to a new subprocessor
Customers with an active subscription can object to a new subprocessor during the notice window by emailing privacy@farshorelabs.com. If the objection cannot be resolved, the customer may terminate the affected subscription for cause and receive a pro-rata refund of any prepaid fees for the unused remainder of the billing period.