Subprocessors
Every third party that touches your data, what it does, and what it receives. This page forms Annex III of the data processing addendum.
These providers are involved in running ShellOrbit. Each does one job, each is bound by a written agreement with confidentiality and security obligations, and none may use your data for its own purposes. This page forms Annex III of the data processing addendum.
Changes in version 1.3. From 19 October 2026, our previous email provider is no longer a subprocessor and every email we send goes through Amazon SES. Zoho Campaigns and Zoho Desk are new, and Zoho CRM gains a new purpose; they apply from the same date. See section 2.
1. Current subprocessors
| Provider | Purpose | Data it processes | Role |
|---|---|---|---|
| Amazon Web Services | Hosting in the US East (N. Virginia) region: compute, event storage, object storage for oversized payloads, queueing, delivery, backups, logs, content delivery for the site and dashboard, and all transactional email through Amazon SES, sent from no-reply@shellorbit.com: sign in codes, delivery failure alerts, weekly digests, security and billing notices. Also the Leak Alarm scanning of verified domains, connected GitHub repositories, and log drains, and the tripwire addresses, links, and fake AWS key endpoints | Account data and event data, including headers and raw payload bodies. For email, the recipient address, message content, and delivery metadata; alert emails reference endpoint names and event identifiers, not payload bodies. For Leak Alarm, findings with masked values, one way fingerprints, and tripwire hit records including source IP address and user agent; page, repository, and log content is scanned and discarded, not stored | Infrastructure processor |
| WorkOS | Authentication, session issuance, single sign on where you use it | Email address, name where provided, authentication identifiers, session and login metadata, IP address | Processor for account data |
| Dodo Payments | Payment processing as merchant of record, tax collection and remittance, invoicing, subscription billing including metered usage | Billing name and email, country, payment instrument held by Dodo Payments, transaction and tax records, metered event counts we report for billing | Merchant of record and independent controller for payment data |
| Zoho Corporation, Zoho CRM | Handling enquiries sent through the contact form on shellorbit.com and the correspondence that follows. Also a record of each ShellOrbit account for account management. India data centre (zoho.in) | For enquiries: first and last name, email address, company, position where given, subject, and the message body you type. For account records: email address, name, sign in method, plan, billing cycle, monthly revenue, account and user ids, UTM source, medium and campaign, referring site, first page visited, signup date, last active date, and lifecycle stage. Nothing from your webhook payloads or Leak Alarm findings | Processor for enquiry and account data |
| Zoho Corporation, Zoho Campaigns | Product update email, sent only to people who ticked the marketing consent box and confirmed it. India data centre (zoho.in) | Email address, name, the consent record, subscription status, and the delivery and engagement data Zoho Campaigns records for each email | Processor for marketing data |
| Zoho Corporation, Zoho Desk | Support tickets created in the dashboard, and the email replies that follow. India data centre (zoho.in) | Contact email address and name, ticket subject and description, plan, account and user ids, ticket status and priority, and the correspondence on the ticket. Nothing from your webhook payloads unless you paste it in | Processor for support data |
| Functional Software, trading as Sentry | Error monitoring and performance tracing for the dashboard, the API, and the delivery workers, so a fault is found before you have to report it | Exception type and stack trace, the request path and method that failed, endpoint and event identifiers, browser and operating system, IP address, and the account id of the person who hit the error | Processor for diagnostic data |
Payload bodies reach only Amazon Web Services. The pages, repository content, and log lines Leak Alarm scans are processed only on Amazon Web Services and are discarded once scanned; what is kept is a finding with a masked value such as sk_…a1b2. Authentication, email, payment, account management, marketing, support, and monitoring providers receive account level data, not the contents of your webhooks and not your findings.
Sentry deserves a specific statement, because error reporting is the usual way payload data leaks into a third party by accident. Request and response bodies are stripped before an event leaves our systems, headers named for authorization, cookies, or signatures are removed, and the scrubbing runs on our side rather than relying on Sentry’s own filters. What Sentry receives is the shape of a failure: which code path broke, on which endpoint id, for which account. If a payload fragment ever reaches it inside an exception message, that is a bug, and reporting it to security@shellorbit.com is welcome.
The contact form posts directly from your browser to Zoho, so an enquiry does not pass through our own servers before it reaches the CRM. Sending it is your choice: every address on the contact page reaches us by ordinary email instead. Zoho CRM, Zoho Campaigns, and Zoho Desk run in Zoho’s India data centre.
Services you connect to ShellOrbit yourself, such as GitHub for repository scanning, Postman, a log platform, or an AWS, OpenAI, or GitHub account you allow us to revoke keys in, are your own providers, not our subprocessors. We act in them only through the access you grant, and you can withdraw it at any time.
2. Changes taking effect
| Change | Date | What it means |
|---|---|---|
| Previous email provider removed | 19 October 2026 | All transactional email is sent through Amazon SES. Removing a provider needs no notice period. |
| Zoho CRM, new purpose | 19 October 2026 | A record of each ShellOrbit account, as listed in the table above, in addition to contact form enquiries. |
| Zoho Campaigns added | 19 October 2026 | Product update email, only for people who opted in and confirmed. |
| Zoho Desk added | 19 October 2026 | Support tickets created in the dashboard, with replies by email. |
3. What is deliberately absent
- No advertising platform and no marketing analytics. Product update email goes only to people who opted in.
- No session recording or heatmap tool.
- No customer data platform, data broker, or enrichment service.
- No model training on payload content or on Leak Alarm findings, by us or by anyone else.
- No third party error tracker with access to raw payloads.
4. Notice of change
We give at least 30 days notice before adding or replacing a subprocessor. Notice goes by email to account holders and this page is updated on the same day. To receive notices at a different address, tell us at privacy@shellorbit.com.
Customers may object to a new subprocessor on reasonable data protection grounds within the notice period, under section 6 of the data processing addendum. If we cannot offer an alternative, you may terminate the affected part of the service and receive a pro rata refund of prepaid fees for the unused remainder of the term.
5. Questions
Write to privacy@shellorbit.com for a copy of the transfer mechanisms in place with any provider on this list, or for the audit and certification reports we are permitted to pass through.