Subprocessors

Faultrix uses best-in-class infrastructure providers, each selected for security, reliability, and GDPR compliance.

• Subprocessors are third-party vendors we engage to process personal data on our behalf to deliver the services.
• The Role column (Processor/Subprocessor) is provided for transparency and may vary by processing context and contract type.
• Data categories are limited to what is necessary and may vary by feature and consent (e.g., analytics).
• If processing occurs outside the EU/EEA, we use appropriate safeguards (e.g., SCCs) where required.
• Changes to subprocessors are documented by updating this page and its change log.

• 2/7/2026: Initial publication of the vendors/subprocessors documentation.
• 2/11/2026: Expanded the subprocessors table with enterprise fields (role, data categories, transfer mechanism, links, review date).
• 2/11/2026: Harmonized vendor list and purposes with Security/Privacy/Cookies references.

• We use data processing agreements (DPAs) under GDPR Article 28 where required.
• Transfers outside the EU/EEA use appropriate safeguards (e.g., SCCs) where required.
• DPA information is available upon request.

• Security certifications (SOC 2, ISO 27001, or equivalent).
• GDPR compliance and DPA availability.
• Data residency options.
• Incident response SLA.
• Financial stability and market position.

• Auth: Clerk can be migrated to Auth0, Firebase Auth, or a self-hosted stack.
• Database: Convex supports data export and migration paths to PostgreSQL.
• Storage: R2 is S3-compatible and can migrate to any S3 provider.
• AI: The Faultrix Engine runs in a provider-agnostic pipeline and backend providers can be switched.
• Payments: Stripe can migrate to other PSP providers.
• Data export: Full data export available within 30 days of request.
• No vendor lock-in by design.

• Annual vendor security review.
• Continuous uptime monitoring.
• Incident notification within 24 hours.
• Last review date: February 2026.