I. Effective date
Effective date: 21 August 2026
Processor: The Wall d.o.o., Mestni trg 10, 1000 Ljubljana, Republic of Slovenia (d.o.o. = Slovenian private limited company, equivalent to “Ltd” in English)
This list describes third parties that process personal data on our behalf to deliver the Blekline Services. We update this list when we engage new subprocessors or change processing activities.
Subscribe to changes: email hello@blekline.com with subject “Subprocessor updates”.
Enterprise customers with a DPA receive 30 days' advance notice of material subprocessor changes as specified in their agreement.
II. Infrastructure and hosting
Default SaaS (EEA): Serverless functions in Frankfurt, Germany (fra1); database in Ireland (eu-west-1). Static assets may be delivered via Vercel’s global CDN. Cross-region traffic stays within the EEA.
Default SaaS (EEA): Serverless functions in Frankfurt, Germany (fra1); database in Ireland (eu-west-1). Static assets may use Vercel’s global CDN. Cross-region traffic stays within the EEA.
| Subprocessor |
Purpose |
Data processed |
Location |
| Vercel Inc. |
Hosting, serverless functions for web app and APIs |
IP address, request logs, app traffic, deployment metadata |
Default SaaS · EU Central (Frankfurt, fra1)
CDN edge may serve static assets globally
Enterprise US · US East (iad1)
when US Processing Addendum applies
|
| Supabase, Inc. |
Managed PostgreSQL database |
Account, workspace, billing metadata, audit events, integration config |
Default SaaS · EU West (Ireland, eu-west-1)
Enterprise US · US region
when US Processing Addendum applies
|
| Webflow, Inc. |
Marketing website CMS and hosting (blekline.com) |
IP address, page views, form submissions, CMS content |
United States (CDN may serve globally) |
III. Optional infrastructure
| Subprocessor |
Purpose |
Data processed |
Location |
| Upstash, Inc. |
Distributed rate limiting (when UPSTASH_REDIS_* configured) |
Request metadata, rate-limit keys |
United States / EU per project region |
| Cloudflare, Inc. |
DNS / CDN for blekline.com; Turnstile bot protection on app signup; Web Analytics beacon |
IP address, request metadata, bot-challenge tokens; aggregated page analytics (cookieless) |
Global edge; United States |
IV. Payments
| Subprocessor |
Purpose |
Data processed |
Location |
| Stripe, Inc. |
Payment processing, subscriptions, invoicing |
Billing email, payment method metadata, transaction records |
United States; EU entities where applicable |
V. AI and masking
| Subprocessor |
Purpose |
Data processed |
Location |
|
Microsoft Corporation
Azure AI Language — Text Analytics for PII
|
PII detection for cloud masking (/api/mask, MCP blekline_mask_prompt) |
Text submitted for masking (transient, on processing path) |
Default SaaS · Germany West Central
Enterprise US · US Azure region
when US Processing Addendum applies
Sidecar local_only: no Azure call — processing stays in customer network
|
VI. Authentication
| Subprocessor |
Purpose |
Data processed |
Location |
| Google LLC |
OAuth sign-in (optional) |
Email, name, profile ID |
United States |
| GitHub, Inc. (Microsoft) |
OAuth sign-in (optional) |
Email, username, profile ID |
United States |
| LinkedIn Corporation (Microsoft) |
OAuth sign-in (optional) |
Email, name, profile ID |
United States |
VII. Communications
| Subprocessor |
Purpose |
Data processed |
Location |
| Resend, Inc. |
Transactional email (auth, billing, enterprise leads) |
Email address, message metadata |
United States |
| MailerLite, UAB |
Marketing email list (if subscribed) |
Email, preferences, campaign metadata |
European Union (Lithuania) |
| Make (Celonis SE) |
Workflow automation (app events → ESP) |
Email, segment tags (minimal) |
EU / US per scenario configuration |
| Cal.com, Inc. |
Meeting scheduling (pilot, assessment, VC intro) |
Name, email, company (if provided), booking metadata |
United States / EU per Cal.com region |
Authenticated web app only. Session replay is disabled. Events are proxied first-party via app.blekline.com/ingest.
| Subprocessor |
Purpose |
Data processed |
Location |
| PostHog, Inc. |
Product usage analytics on the authenticated web app |
Page views, UI interactions, pseudonymous device IDs; user/workspace ID when logged in |
EU cloud (eu.posthog.com) |
Session replay is disabled. Events are proxied first-party via app.blekline.com/ingest.
IX. Analytics and marketing (marketing site only, with consent)
Marketing site only — loaded when you consent via the cookie manager.
| Subprocessor |
Purpose |
Data processed |
Location |
|
Google LLC
Tag Manager / Analytics
|
Website analytics when consented |
Usage data, device identifiers |
United States |
|
Apollo.io, Inc.
if enabled via GTM
|
B2B marketing enrichment when consented |
Business contact data |
United States |
|
GetEmails, LLC d/b/a RB2B
RB2B visitor identification
|
B2B visitor identification on blekline.com (marketing consent) |
IP, device identifiers, pages viewed; US person-level ID (geofenced); optional company-level ID |
United States |
RB2B person-level ID is US-only (vendor IP geofence). Gate the pixel with marketing consent. Opt-out: app.retention.com/optout.
RB2B notes: Script loads on the marketing site only, gated by marketing consent. Person-level identification is US-only per vendor. Global company-level identification (if enabled) requires a consent manager. RB2B may operate as an independent controller for its identification graph — see rb2b.com/privacy-policy. Visitor opt-out: app.retention.com/optout.
X. Transfer mechanisms
Where personal data is transferred from the EEA/UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (EU Commission 2021/914) and the UK Addendum where applicable, plus supplementary measures as required.
Enterprise customers may execute a Data Processing Agreement with Module Two SCCs. See enterprise sales.
XI. Contact
Questions about subprocessors: hello@blekline.com
Related: Privacy Policy · DPA outline · Enterprise DPA available on request — enterprise@blekline.com
