Subprocessors
Last updated: 2026-05-20
SkyLog uses a small set of vetted third-party services to operate the platform. Each is bound by a written data-processing agreement (DPA) and, where applicable, by the EU Commission’s 2021 Standard Contractual Clauses incorporated into that DPA.
We update this list when we add or remove a subprocessor. Material changes will also bump the Privacy Policy so existing users see the cookie banner re-prompt and re-consent.
Current subprocessors
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Google Cloud Platform (incl. Firebase) | Application hosting (Cloud Run), database (Cloud SQL via Firebase Data Connect), object storage (Cloud Storage), authentication (Firebase Auth), push notifications (FCM), fraud prevention (App Check + reCAPTCHA v3), analytics (when consented), build pipeline (Cloud Build, Artifact Registry), CDN edge (Firebase Hosting). | United States — us-central1 | View DPA |
| Apple | Sign-in with Apple (when used), Apple Push Notification service for iOS notifications, App Store delivery for the iOS app. | United States / EU (Apple infrastructure) | View DPA |
| Meta (Facebook) | Sign-in with Facebook (when used). No data is shared back to Facebook beyond the OAuth handshake. | United States / EU | View DPA |
| Twilio | SMS delivery for the dropzone-account verify-link flow (when you opt to link your dropzone manifest account). Phone numbers and one-time codes only; no other personal data is shared. | United States | View DPA |
| Upstash | Redis store for rate-limiting counters and short-lived account-link challenges. Stores ephemeral state (phone-number-derived keys, attempt counters); no jump or profile data. | Depends on the Upstash region selected for our database (currently US; review on request). | View DPA |
| Cloudflare | DNS resolution and (in development) outbound tunnel relays for emulator access. No user data flows through Cloudflare in production beyond DNS query metadata. | Global edge network | View DPA |
| GitHub | Source-code hosting and CI/CD (GitHub Actions). Doesn't touch production user data, but does receive build-time public configuration. | United States | View DPA |
Notification of changes
If you’d like to be notified before we add a new subprocessor (some regulated industries require this for their own auditing), email contact@skyloglive.com and we’ll add you to the change-notification list. We’ll give reasonable advance notice (typically 30 days) before any new subprocessor goes live in production, except for urgent security replacements.
What is NOT a subprocessor
The dropzones whose manifest data you link to your SkyLog account (e.g. via SkyView) are independent data controllers — they’re not our subprocessors, and the data they share with you flows through their own privacy policies. We act as a data processor for that flow when it’s clearly under your control.