Providers and subprocessors
The services selected to operate Trylane, and the role each plays.
Effective 25 October 2026, version 2026-10-25
Infrastructure and service delivery
Providers receive only the information needed for their role. Production accounts, regions and contractual safeguards must match the deployment. Provider headquarters do not describe every processing location; consult each provider’s current subprocessor list. Contact us for the locations and transfer safeguards used for your workspace.
| Provider | Function and data | Role / location considerations |
|---|---|---|
| Vercel | Web/API hosting; HTTP requests and limited service logs. | Infrastructure processor; deployment region plus global network/support processing. |
| Neon | Production control-plane PostgreSQL metadata. | Database processor; selected project region and documented subprocessors. |
| Railway | Continuously running lifecycle worker; the operator’s separate reference app/agent where hosted. | Infrastructure processor; selected service region. Customer-operated agents use their own hosting. |
| Cloudflare | DNS, network protection and incoming email routing. R2 is the selected provider if a file-storage feature is introduced. | Network/mail processor with global processing. No file-upload feature or R2 object collection is currently provided. |
| Clerk | Authentication, identity IDs, email and configured profile/security information. | Authentication processor for service identity; some provider security processing may have a separate controller basis. |
| Resend | Invitation/support email content, recipient addresses and delivery status. | Transactional email processor. Incoming mail is routed to the operator’s private inbox, not a public inbox address. |
| Sentry | Sanitized necessary server errors; browser errors only with diagnostics consent. | Diagnostics processor; project region, network processing and plan retention apply. |
Optional measurement and separate services
| Provider | Use | Control |
|---|---|---|
| Google Analytics | Selected public-page measurement; no advertising features or user-ID integration. | Analytics consent required; Google data-processing terms and applicable independent-controller processing apply. |
| PostHog | Allowlisted public/workspace page views with ephemeral identifiers and no recordings. | Analytics consent required; EU ingestion endpoint is the code default; the project must be created in the matching region. |
| Polar | Merchant of record, checkout, tax, invoices, subscription/payment administration. | Independent controller for its merchant/legal functions; its buyer terms and privacy policy apply. |
| Google or GitHub sign-in | The sign-in provider you select, connected through Clerk. | Independent identity-provider services governed by their own notices. Choosing one is not analytics consent. |
Updates
Processor changes follow the notice and objection process in our Data Processing Addendum. We update this page when the provider list or processing role materially changes. Questions: privacy@trylane.app.
Questions about this document? contact@trylane.app