Sub-processors
These are the only third parties that process customer data on Denby's behalf: Cloudflare for hosting and file storage, Neon for the database, Resend for email, Whop for subscription billing, and Google Cloud Run for virus scanning. We email firm owners at least 30 days before adding or replacing one.
All customer data is stored in the United States. Each provider below receives only the data it needs for its job. Our data processing agreement explains how you’re told about changes and how to object.
| Provider | What it does for Denby | Data it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Runs the app and website, stores uploaded files (R2), rate limiting, caching and website visit statistics (Web Analytics, without cookies) | All customer data in transit; files at rest | Global network; files stored in eastern North America (United States) |
| Neon, Inc. | Hosts the Postgres database | Account, firm and client records, messages, audit log | United States (US East, Ohio) |
| Resend, Inc. | Sends email: sign-in links, reminders, notifications | Recipient email address, name and email content | United States |
| Whop, Inc. | Subscription billing and card payments for Denby plans | Firm owner’s name, email and billing details | United States |
| Google LLC (Google Cloud Run) | Runs our virus scanner (ClamAV, which we build and operate ourselves) | Uploaded files, only while they’re scanned; never stored | United States (us-east5, Columbus, Ohio) |
Your own clients’ payments go through whichever payment link you add to an invoice. That provider works for you, not for Denby, so it isn’t on this list.
Changes
We email firm owners at least 30 days before a new sub-processor starts processing customer data. The date at the top of this page shows the last change. For questions, email privacy@denby.app, or read how we protect data on our security page.