This document lives alongside placeholder copy. The surrounding privacy policy and terms of service are draft templates pending legal review. The sub-processor list below, however, is kept up to date with the providers actually used by Grid — read it as a current statement of the infrastructure layer, even if the policy framing around it is still being finalised.
What is a sub-processor?
A sub-processor is a third-party service Grid contracts with to process customer data on Grid's behalf — for example, the database vendor that stores the records you create, or the email vendor that delivers transactional notifications. Sub-processors operate under contractual obligations that mirror Grid's own commitments to you and are restricted to processing the data only for the purposes Grid sets out.
Current sub-processors
The table below lists every active sub-processor as of 2026-05-20. The region column reflects the primary processing location; some providers operate globally distributed networks (Cloudflare R2 in particular).
| Provider | Purpose | Region | Privacy |
|---|---|---|---|
| MongoDB Atlas | Primary application database | US / EU (per tenant) | Policy |
| Cloudflare R2 | Object storage for file attachments and documents | Global (R2 distributed network) | Policy |
| Stripe | Billing and subscription processing | United States | Policy |
| Resend | Transactional email delivery | European Union | Policy |
| OpenAI | AI agent inference and model access | United States (region selectable) | Policy |
| Twilio | WhatsApp Business API and SMS messaging | United States | Policy |
| Pusher | Push notification delivery | United States | Policy |
| BullMQ + Redis | Background job queues (self-hosted or via Upstash) | EU / US (per deployment) | Policy |
Customer-specific configurations may invoke additional sub-processors on a per-tenant basis — for example, when a tenant connects a custom Gmail or Microsoft 365 inbox, the corresponding provider becomes a tenant-specific processor for that data. These integrations are opt-in and visible inside Grid's tenant settings.
How we notify you of changes
We notify customers in writing at least thirty days before adding a new sub-processor that handles personal data, or before changing the primary processing region of an existing sub-processor. Notifications are sent to account administrators by email and published in the changelog.
If you object to a new sub-processor, you may raise the objection by replying to the notification email. Where the objection is reasonable and cannot be resolved, we will work with you to identify a path forward, which may include terminating your subscription with a pro-rata refund of any prepaid fees for the unexpired portion of the term.
Contact
Questions about this list, including requests for signed DPAs and sub-processor flow-through agreements, should be sent to [email protected]. Notifications about sub-processor changes are sent to the email address registered for the account administrator of each tenant.