# DPA and sub-processors

> Applane is a processor for admin and builder emails, a controller for billing contacts. Sub-processors: Supabase, Cloudflare, Stripe, an EU email provider.

Source: https://docs.applane.dev/security/dpa-and-sub-processors/

## Roles

For the data Applane holds about your employees (admin and builder email addresses, seat activity), Applane is a **processor** acting on your instructions: you decide who uses the product. For your billing contact, Applane is a **controller**.

Applane does not process the contents of your apps, your sheets, your prompts or your documents, because none of it reaches Applane. See [Data flow](https://docs.applane.dev/security/data-flow/).

## Sub-processors

| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and backend functions: tenant configuration, seats, licences | Frankfurt, Germany (EU) |
| Cloudflare | Network edge and static hosting for the website, the console and this site | EU data localisation enabled |
| Stripe | Invoicing and payment processing | EU entity; Stripe holds the billing contact |
| Email provider (to be named) | Transactional email: licence and admin notices | EU |

Data stays in the EU. Changes to this list are announced to every admin by email at least 30 days before they take effect.

## The DPA

Applane's data processing agreement is based on the standard EU processor clauses (GDPR Article 28). Its annex lists the two data categories (admin and builder emails; seat and admin activity), the sub-processors above, EU hosting, breach notification within 72 hours, the deletion timelines on [Where things are stored](https://docs.applane.dev/security/where-things-are-stored/), and audit rights met by this documentation.

Request it from the support address shown in the console, or from the security page on [applane.dev](https://applane.dev/security). Companies that need their own paper can send it for review; the obligations are the same whatever the template says.

## Security controls, in short

- Extension: no tokens in extension storage, sandboxed preview, no remote code, a content security policy.
- Backend: row-level security on every tenant table, writes through audited functions, secrets in a vault, licences signed with ES256, ID token audience and nonce checks, rate limits on the public endpoints.
- Operations: two-factor authentication on every account that can touch production, pinned dependencies with automated scanning, daily backups.
- A written incident process: who is told, within what time, by which channel.

SOC 2 is not in place. The interim evidence for a security review is this site, the [Data flow](https://docs.applane.dev/security/data-flow/) page, the Internal-client posture ([No Google app verification needed](https://docs.applane.dev/gcp-admins/no-verification-needed/)), the sub-processor list, and the DPA.