Sub-processors
Sub-processor list
Last updated: 2026-05-06
BookSlash relies on the third-party sub-processors below to deliver the service. Each is contractually bound to handle customer data only as instructed by us, with appropriate security measures, and only for the purposes described. We update this page when we add or remove a sub-processor.
How we notify you of changes
Customers who have signed our Data Processing Agreement may subscribe to advance notice of sub-processor changes by emailing privacy@bookslash.app. We provide at least 30 days' advance notice for material additions.
Current sub-processors
| Purpose | Data accessed | Region |
|---|---|---|
| Application server hosting (managed VPS). Runs the BookSlash web tier and persistent volumes. | Request metadata, application logs, on-disk state (encrypted at rest). | United States |
| Managed relational database for primary data storage. | All customer content stored in the application database. | United States |
| Subscription billing and Merchant of Record (Paddle). Paddle acts as an independent data controller for payment data — see paddle.com/legal/privacy. | Billing contact, card data (Paddle-hosted). BookSlash retains subscription status and invoice reference IDs only. | United Kingdom / United States |
| Transactional email delivery (sign-in, billing, account events). | Email address, email content, delivery metadata. | United States |
| Application error monitoring and performance tracing. | Error stack traces, request IDs, scrubbed request metadata. | United States |
| DNS, TLS termination, and DDoS protection for our domains. | IP address, request metadata. | United States (global edge) |
| OAuth identity provider when users sign in with GitHub. | OAuth profile, email address. | United States |
| OAuth identity provider when users sign in with Google. | OAuth profile, email address. | United States |
| Uptime monitoring and the hosted public status page at status.bookslash.app. | Public health-probe URLs only — no customer data is shared with this vendor. | United States |
Questions
For questions about a specific sub-processor or to request a copy of our DPA, email privacy@bookslash.app. The full Privacy Policy is at /legal/privacy.