Sub-processors
Last updated: 21 July 2026
BuiltSign (Crul.Dev, KVK 97533114) uses the following third-party sub-processors to provide its service. All sub-processors are contractually bound by the same or stricter obligations as our Data Processing Agreement (DPA).
1. What are sub-processors?
A sub-processor is any third party engaged by BuiltSign to process personal data on behalf of our customers. We only engage sub-processors that provide sufficient guarantees of appropriate technical and organisational measures in accordance with GDPR Article 28(2).
2. Current sub-processors
As of 21 July 2026. Changes are announced at least 30 days in advance.
Supabase Inc.
Database & authentication
- Primary location
- EU (Frankfurt)
- Transfer basis
- SCC 2021/914
Amazon Web Services EMEA SARL
Object storage (S3)
- Primary location
- EU (Stockholm)
- Transfer basis
- Adequacy (EEA)
Render Services Inc.
Backend hosting
- Primary location
- EU region
- Transfer basis
- SCC 2021/914
Vercel Inc.
Frontend hosting & edge
- Primary location
- EU region / global CDN
- Transfer basis
- SCC 2021/914
Mollie B.V.
Payment processing
- Primary location
- NL (EU)
- Transfer basis
- EEA, no transfer
Didit B.V.
Identity & biometric verification (optional)
- Primary location
- NL / EU
- Transfer basis
- EEA, no transfer
Twilio Ireland Ltd.
SMS one-time passwords (optional)
- Primary location
- EU (Dublin)
- Transfer basis
- Adequacy (EEA)
Upstash Inc.
Rate limiting (short-lived IP data, TTL ≤ 24h)
- Primary location
- EU (Frankfurt)
- Transfer basis
- SCC 2021/914
DigiCert Inc.
RFC 3161 trusted timestamps
- Primary location
- US (document hash only)
- Transfer basis
- SCC 2021/914
hCaptcha (Intuition Machines Inc.)
Bot protection
- Primary location
- EU edge
- Transfer basis
- SCC 2021/914
Resend Inc.
Transactional email
- Primary location
- EU region
- Transfer basis
- SCC 2021/914
| Sub-processor | Service | Primary location | Transfer basis |
|---|---|---|---|
| Supabase Inc. | Database & authentication | EU (Frankfurt) | SCC 2021/914 |
| Amazon Web Services EMEA SARL | Object storage (S3) | EU (Stockholm) | Adequacy (EEA) |
| Render Services Inc. | Backend hosting | EU region | SCC 2021/914 |
| Vercel Inc. | Frontend hosting & edge | EU region / global CDN | SCC 2021/914 |
| Mollie B.V. | Payment processing | NL (EU) | EEA, no transfer |
| Didit B.V. | Identity & biometric verification (optional) | NL / EU | EEA, no transfer |
| Twilio Ireland Ltd. | SMS one-time passwords (optional) | EU (Dublin) | Adequacy (EEA) |
| Upstash Inc. | Rate limiting (short-lived IP data, TTL ≤ 24h) | EU (Frankfurt) | SCC 2021/914 |
| DigiCert Inc. | RFC 3161 trusted timestamps | US (document hash only) | SCC 2021/914 |
| hCaptcha (Intuition Machines Inc.) | Bot protection | EU edge | SCC 2021/914 |
| Resend Inc. | Transactional email | EU region | SCC 2021/914 |
3. Changes to this list
Intended additions or replacements of sub-processors are announced at least 30 days in advance via the mechanism set out in our DPA. Customers with an active DPA may raise a reasoned objection within that period on legitimate privacy grounds.
4. Questions
For questions about our sub-processors or to request a copy of our DPA, contact us at legal@builtsign.com.