Sub-processors
Everyone who processes data on Maskbreak's behalf, what they do, what they touch and where; the same regions are stated in Annex C of the DPA. Our application hosting and primary database are in the United States; backups are in the EU. New sub-processors that process customer data are announced at least 30 days in advance in the change log below, with right to object.
Last updated 20 October 2026 · maintained by Sentinel Edge Networks LTD
Current sub-processors
| Provider | Purpose | Data touched | Region |
|---|---|---|---|
| Cloudflare | CDN, TLS termination, edge caching, firewall and rate-limit rules, and Workers (an uptime check, an edge answer for direct requests to the live check’s first pass, and the receiver that writes the nightly backup into R2); since 17 October 2026 also R2 storage for the encrypted nightly database backups (disaster recovery); since 19 October 2026 also Email Service, which delivers our email (verification codes, password resets, security notices, form receipts, setup emails, monthly summaries and the newsletter) through a Worker; since 19 October 2026 also D1, our primary database, which our server reaches only through a Worker; since 20 October 2026 also Browser Run, a browser that opens a page an account holder names in the dashboard’s page check; since 20 October 2026 also Containers, which run our application server (all traffic to the website and API) and keep its application logs for 7 days | Request metadata (IP, headers) in transit. Email: the recipient’s address and the message, in transit. Backups: full database snapshots, encrypted at rest; a rule removes each copy after 40 days, within the 60-day retention commitment that a daily audit checks. Restoring a backup stays blocked until post-restore deletion is verified. Database (since 19 October 2026): account data and sessions (IP address and user agent), API keys, evaluation records (raw end-user IP addresses for up to 7 days, then a keyed hash), abuse-prevention counters and newsletter subscriptions, encrypted at rest. Page check (since 20 October 2026): the page address an account holder enters, in transit; no end-user data, and we keep neither the address nor the result. | Global edge network; database: United States (Eastern North America); backups: EU (R2 EU jurisdiction) |
| Railway | Application hosting and application logs (kept by Railway for up to 30 days) until 20 October 2026; since then a stand-by copy of our server without traffic, to be removed by 27 October 2026 | All application traffic and data in transit and in use; logs with request paths, error descriptions and security events | United States (US East) |
| Turso | Former primary database (managed libSQL), until 19 October 2026; the database was deleted and our account closed the same night, and copies Turso may still hold in its own backups follow its retention terms | Account data and sessions (IP address and user agent), API keys, evaluation records (raw end-user IP addresses for up to 7 days, then a keyed hash), abuse-prevention counters, newsletter subscriptions | United States (AWS us-east-1, Virginia) |
| Amazon Web Services (S3) | Former backup store: the encrypted nightly database backups made up to 16 October 2026 (no new copies since) | Full database snapshots, encrypted at rest; 60-day retention commitment, which the daily audit confirmed from 10 October 2026. A rule set to delete them within the 60-day limit was in place; the account is suspended and we are not restoring access to it, so we can no longer check or delete these copies ourselves | EU (Stockholm, eu-north-1) |
| GitHub (GitHub, Inc.) | GitHub Actions: the nightly backup job, which for a few minutes each night reads the full database on a GitHub-hosted runner, compresses it and uploads it to Cloudflare R2 (to AWS S3 until 16 October 2026); scheduled monitoring checks. Also GitHub Sign-In (OAuth), used only when an account holder chooses it; no analytics, no advertising | Backup job: the full database while the job runs (including account records and evaluation records with raw end-user IP addresses under 7 days old). Monitoring: pass/fail outcomes, no customer records. Sign-In: the account holder’s OAuth identity assertion | United States and other locations where GitHub-hosted runners operate |
| Resend | Former email provider: delivered all our email (verification codes, password resets, security notices, form receipts, setup emails, monthly summaries and the newsletter) until 19 October 2026, when Cloudflare took over; removed the same day, and our Resend account was closed the same night; copies Resend may still hold in its own backups follow its retention terms. | Email address, message content | United States |
| Stripe (Stripe, Inc. and its affiliates) | Payments, subscriptions, invoices and receipts for paid plans, since 30 September 2026. Checkout and the billing portal are pages hosted by Stripe on its own website; no Stripe script runs on maskbreak.com. Also acts as an independent controller for its own fraud-prevention and regulatory purposes. Listed for transparency: it receives no customer end-user data | Account holders’ billing data only: the account’s email address and plan, payment and billing details entered on Stripe’s pages (card details go straight to Stripe and never reach our servers), and the IP address and browser details of the device used there. Provider privacy policy | United States and other countries where Stripe operates |
| Network-intelligence provider and device-intelligence provider (listed by category) | VPN/proxy/Tor/datacenter classification and device-integrity signals for evaluations; their scripts run in the visitor’s browser from maskbreak.com subdomains. Their standard terms may also allow them to use signals collected through their scripts for their own purposes (for example to maintain and improve their services, for security, or in de-identified and aggregated form); for that use they act under their own terms | IP address and an encrypted network token; browser/device characteristics, pseudonymous device identifiers and security signals. Each provider’s name, address and processing location are given to customers on request under the DPA, as confidential information (support@maskbreak.com) | United States |
| Email- and phone-intelligence provider (listed by category), since 18 October 2026 | The console’s email and phone check: when an account holder types one email address or one phone number into it, our server sends that value to this provider and shows the account holder a summary of the answer (whether the address accepts mail and its domain’s details, how long it has been seen online and on how many sites, in how many known data breaches it appears, a phone number’s validity, line type and carrier, how many businesses checked it before or reported it as fraud, and the provider’s risk score). A daily number of checks per account, set by its plan. Its standard terms may also allow it to use the addresses and numbers it is asked about for its own purposes, such as the fraud history it keeps across its customers; for that use it acts under its own terms | Only the email address or phone number the account holder types: no account, API-key, evaluation or visitor records. Maskbreak stores neither the value nor the answer, only how many checks the account made that day (kept 3 days). The provider’s name, address and processing location are given to customers on request under the DPA, as confidential information (support@maskbreak.com) | United States |
| Widgo (Widgo, Inc.) — legacy records only | Former AI chat provider on public marketing pages, from 22 September 2026 until its removal on 30 September 2026; no page loads the widget now. | Historical chat transcripts, volunteered details and the visit data it received while loaded (IP, browser/device identifiers, page/referrer/campaign data, interaction timing), kept while needed for support or legal obligations; access and deletion requests remain available. Never supplied with Maskbreak account, API-key or evaluation records. Provider privacy policy | United States, EU and other locations in Widgo’s privacy policy |
| PostHog (PostHog, Inc.) | Product analytics and session recordings on public pages, /signup and the dashboard since 23 September 2026, without a consent prompt; skipped under Global Privacy Control, Do Not Track and Save-Data. Never on sign-in, reset, verification, invitation, settings, security, members, admin or result pages. The library is served from maskbreak.com at a fixed version; PostHog receives data, never runs code on our pages. | Pages viewed, clicks, referrer, browser/device type, IP address, a random browser identifier, and session recordings with every form field, the visitor’s own network readouts and all dashboard text masked. Not supplied with account, API-key or evaluation records. Provider privacy policy | EU (PostHog EU Cloud, Frankfurt); PostHog’s DPA permits processing elsewhere, including the United States |
| Sentry (Functional Software, Inc.) | Error reports from Maskbreak’s server software since 24 September 2026, sent only when the server hits an unexpected error. Server-side only: no Sentry code on our pages and nothing stored in visitors’ browsers. Errors only — no performance tracing, profiling, log forwarding or session replay. | Error type, message and stack trace, runtime details, release and environment, the request method and path with IP addresses, email addresses, identifiers (UUIDs, account and record numbers, long hexadecimal strings) and token-like segments replaced by placeholders, and, for up to 30 recent outgoing calls, only the method, status code and origin (scheme, host name and port; no path or query), so a customer’s webhook host name can appear. Request headers, cookies, bodies, query strings, IP addresses, email addresses, the user/account profile, API keys, secrets and tokens are removed before sending, so it is designed not to receive customer or end-user personal data; the removal is pattern-based, a strong safeguard rather than a guarantee. Sentry’s generative AI features are off, so error data is not sent to its AI sub-processors. Provider privacy policy | EU (Sentry EU region, Frankfurt); Sentry’s DPA permits processing in the United States |
| Crisp (Crisp IM SAS) — legacy records only | Former live-chat provider, replaced on 8 September 2026; no new browser widget loading. | Historical chat transcripts and metadata while needed for support or legal obligations; access and deletion requests remain available. | EU (France) |
Optional Google Sign-In. On /login Google’s sign-in client also loads by itself after the page has loaded (since 24 September 2026) to offer its “Continue as …” prompt (One Tap), except for browsers that send Global Privacy Control or Do Not Track. Google Ads measurement was removed on 6 September 2026. Also Google Workspace, which hosts our support@maskbreak.com mailbox. | OAuth identity assertion and sign-in request metadata when this option is used; on /login, the visitor’s IP address and browser details when the client loads, whether or not the prompt is used. Workspace: the emails sent to support@maskbreak.com (including relayed contact and programme forms) and our replies; customer end-user data only where a customer writes it into an email | United States and other Google locations | |
| Have I Been Pwned | Password breach check via k-anonymity | 5-character SHA-1 prefix only — never the password | Global service; receives no personal data |
| flagcdn.com | Flag images in the console’s test panel, fetched by the account holder’s browser when a console test result is shown. Listed for transparency; it receives no customer end-user data | The account holder’s IP address and browser details, and the two-letter country code of the test result | Not published by the provider |
Fonts are self-hosted. Google Ads remains removed. No chat widget loads on any page since 30 September 2026 (Widgo and Crisp keep legacy records only). The Auth0 tenant behind the former emailed sign-in link was deleted on 6 October 2026. PostHog records sessions on public pages, sign-up and the dashboard, with form fields, the visitor’s own network readouts and all dashboard text masked. Stripe sells paid plans as the merchant of record through its Managed Payments service (shown to buyers as Link) and handles the payments, tax, receipts and invoices on its own pages and receives no customer end-user data. Sentry receives server error reports only, with personal data removed on our server by pattern-based scrubbing. GitHub Actions runs the nightly backup job, which reads the full database. Google Sign-In is separate. See the Privacy Policy and Cookie Policy for storage details and the former chat providers.
Change log
| Date | Change |
|---|---|
| 2026-10-20 | Application hosting moved to Cloudflare. Our application server now runs on Cloudflare (Containers, Eastern North America), already listed above, which receives all traffic to the website and API, as Railway did, and keeps the application logs for 7 days. Railway keeps a stand-by copy of the server, without traffic, until we remove it by 27 October 2026; its logs follow its own retention (up to 30 days). A customer may object to this change on reasonable data-protection grounds until 19 November 2026 (support@maskbreak.com). Cloudflare also runs the dashboard’s page check. Cloudflare, already listed above, now also opens, once, a page address an account holder enters in the dashboard’s setup screen (Browser Run) and tells our server what it saw of our script there. It receives the page address only: no end-user data, and we keep neither the address nor the result. No sub-processor was added or replaced, so the 30-day advance-notice clause does not apply. |
| 2026-10-19 | Email delivery moved to Cloudflare. Cloudflare, already listed above for the CDN, Workers and the backups, now also delivers our email through its Email Service (verification codes, password resets, security notices, form receipts, setup emails, monthly summaries and the newsletter). It receives what Resend received: the recipient’s address and the message. Resend, which delivered our email until then, was removed the same day and is listed above as a former provider. The primary database moved to Cloudflare too: since the same evening it is Cloudflare D1 (United States, Eastern North America), which our server reaches only through a Worker, and it holds what Turso held. Turso, the database until then, was deleted with our account the same night, and our Resend account was closed too; copies either may still hold in its own backups follow its retention terms. Both add a purpose to an existing sub-processor rather than a new one; if you object, tell us at support@maskbreak.com by 2026-11-18 (DPA Section 6). |
| 2026-10-18 | Added: an email- and phone-intelligence provider (listed by category; processing in the United States). Since 18 October 2026 the console offers an email and phone check: an account holder types one email address or one phone number, our server sends that value to this provider and shows the account holder a summary of the answer, with a daily limit of checks per account. The provider receives only the typed value, never account, API-key, evaluation or visitor records, and Maskbreak stores neither the value nor the answer. Its standard terms may also allow it to use the values it is asked about for its own purposes, such as the fraud history it keeps across its customers. The check was switched on the same day as this entry, not 30 days after it: a customer may object to this addition on reasonable data-protection grounds within 30 days of this entry, as DPA §6 provides (support@maskbreak.com), and the check is used only when an account holder starts one. The provider’s name, address and processing location are given to customers on request, as confidential information. Privacy Policy §1, §3, §5 and §5.2 were updated in the same change; DPA version 1.13 (Annex C) and security whitepaper version 2.5, published the same day, list it too. |
| 2026-10-17 | Backups moved from Amazon Web Services to Cloudflare R2. The AWS account that held the encrypted nightly database backups was suspended between the backups of 16 and 17 October 2026, and the backup of 17 October failed. To keep a working backup, the nightly job now uploads to Cloudflare R2 in Cloudflare’s EU jurisdiction (data stored in the EU). Cloudflare was already on this list for the CDN, firewall and Workers; it now also stores the backup copies, encrypted at rest, and a rule removes each copy after 40 days, within the unchanged 60-day commitment that the daily audit checks. The GitHub Actions job is unchanged apart from where it uploads. The copies made up to 16 October 2026 stay in the suspended AWS account, where a rule set to delete them within the 60-day limit was in place; we are not restoring access to it, so we can no longer check or delete them ourselves, and AWS stays on the list for those copies. A customer may object to this change on reasonable data-protection grounds within 30 days of this entry, as DPA §6 provides. Privacy Policy §3 and §5, Cookie Policy §3, the trust page and the responsible-disclosure policy were updated in the same change; DPA version 1.13 and security whitepaper version 2.5 (18 October 2026) describe the move too. |
| 2026-10-11 | Documents brought in line with this list; no sub-processor was added, replaced or removed, so the 30-day advance-notice clause does not apply. DPA version 1.12 Annex C no longer lists Auth0 (deleted 6 October 2026) and lists Widgo for legacy records only (chat removed 30 September 2026); security whitepaper version 2.4 does the same and adds Stripe, which was already on this list. On this page, the Cloudflare row now names its Workers (an uptime check and an edge answer for direct requests) instead of a scanner verdict our pages no longer request from the edge, and the AWS row says that the daily backup-retention audit first passed on 10 October 2026. The Google row now also names Google Workspace, which has hosted the support@maskbreak.com mailbox all along; nothing about its use changed, and the Privacy Policy §1.2 and §5 and the Cookie Policy §3 name it too. |
| 2026-10-06 | Auth0 taken off the list above: we deleted the Auth0 tenant on 6 October 2026, and with it the user record it held for each person who used the former emailed sign-in link. Nothing is sent to Auth0 any more; any copies left in Auth0’s own backups are removed under Auth0’s retention terms. Nothing new was added, so the 30-day advance-notice clause for sub-processors does not apply. Privacy Policy §5 and §5.2, Cookie Policy §3 and §5, the trust page and the responsible-disclosure policy were updated in the same change; DPA Annex C and the security whitepaper keep their dated text until their next versions. |
| 2026-10-05 | Auth0 removed: the emailed sign-in link (“Email me a sign-in link”) was retired on 5 October 2026 and no page or server route contacts Auth0 any more. It moves to the list above as a legacy-records provider: the user records it created for people who used the link stay in the Auth0 tenant until it is closed. Accounts created with the link keep working through Google, GitHub, a passkey or a password set with Forgot password. Nothing new was added, so the 30-day advance-notice clause for sub-processors does not apply. Privacy Policy §4 and §5 and Cookie Policy §2 and §3 were updated in the same change; DPA Annex C and the security whitepaper keep their dated text (“where offered”) until their next versions. |
| 2026-09-30 | Added Stripe (payments, subscriptions, invoices and receipts), because Maskbreak now offers paid plans. They are sold through Stripe’s Managed Payments, so Stripe (shown as Link) is the merchant of record and acts as an independent controller for the checkout and payment. Stripe processes only the billing data of Maskbreak’s own account holders who choose a paid plan: the account’s email address and plan, the payment and billing details they enter on Stripe’s hosted checkout and billing-portal pages, and the IP address and browser details of the device used there. Card details go straight to Stripe and never reach our servers, and no Stripe script runs on maskbreak.com. It never receives customer end-user or evaluation data, so the 30-day advance-notice clause for sub-processors that process customer data does not apply, and it is not added to DPA Annex C. The Privacy Policy §1.1, §2.1, §3 and §5 and the Terms of Service Sections 4 to 6 were updated in the same change. The same day, the Widgo chat was removed from every page: it no longer loads, our Content Security Policy no longer allows its hosts, and Widgo keeps only the historical chat and visit records it already holds (legacy records, as for Crisp). Removing a provider needs no advance notice; the Privacy Policy §1.2, §2.1 and §5, the Cookie Policy §2.4 and the Trust Center were updated. |
| 2026-09-28 | Correction: processing regions. The primary database (Turso) is in the United States (AWS us-east-1, Virginia), not the EU as DPA Annex C stated since the DPA was first published; application hosting (Railway) is in the United States (US East since 2026-09-23, US West before), not “EU / US”; the Auth0 tenant is in the United States. Nothing moved: these rows were wrong. This list now has a Region column, the network- and device-intelligence providers are shown as United States, and DPA Annex C (DPA version 1.10) states the same regions. Transfers continue under DPA Section 10. The Privacy Policy §5 and §5.2, the Cookie Policy §5, the security whitepaper and the trust page were corrected in the same change. |
| 2026-09-28 | Completeness correction: GitHub Actions. Since July 2026 our nightly database backup job has run on GitHub-hosted runners: for a few minutes each night it reads the full database (including evaluation records with raw end-user IP addresses under 7 days old), compresses it and uploads it to AWS S3 in Stockholm. GitHub was listed for sign-in only, so this processing was missing from this list and from DPA Annex C; both now include it. Like the 2026-07-18 entry, this corrects the published list for infrastructure that was already live; no new processing starts with this entry. The backup copy is encrypted at rest in S3. |
| 2026-09-28 | Corrections to sign-in rows. GitHub Sign-In and the Auth0 emailed sign-in link have been offered in production since at least 2026-09-24 (the exact switch-on date was not recorded); the rows that said GitHub was not enabled were out of date. The Google row now also describes the One Tap prompt that /login has loaded automatically since 2026-09-24, which sends Google the visitor’s IP address and browser details whether or not it is used (already stated in Privacy Policy §5 and Cookie Policy §3 on that date). Added flagcdn.com, which serves the flag images in the console’s test panel, for transparency; it receives no customer end-user data. |
| 2026-09-28 | Clarified the network- and device-intelligence providers and how notices are given. Their row now lists everything they process (IP address, encrypted network token, browser/device characteristics, pseudonymous device identifiers and security signals, not only “network metadata”), their region (United States), and that their standard terms may also let them use signals collected through their scripts for their own purposes (for example to maintain and improve their services, for security, or in de-identified and aggregated form); DPA Annex A and Annex C no longer call their processing “transient”. Their names, addresses and processing locations are given to customers on request under DPA Section 6. Sub-processor change notices are given by a dated entry in this change log at least 30 days before a new sub-processor that processes customer data goes live (DPA Section 6, version 1.11). Earlier versions offered email notices to customers who had subscribed, but there was never a way to subscribe; version 1.10, published earlier the same day, said notices would be emailed to account owners, and version 1.11 replaced it. |
| 2026-09-24 | Added Sentry (server error monitoring, Sentry EU region, Frankfurt) to this list and DPA Annex C (DPA version 1.9). When Maskbreak’s server hits an unexpected error it sends Sentry the error, its stack trace, runtime and release details, the request method and path, and the method, status code and origin of recent outgoing calls; request headers, cookies, bodies, query strings, IP addresses, email addresses, API keys, secrets and tokens are removed on our server first, including from error messages. It runs only on our server, never in a visitor’s browser, and sends errors only (no tracing, profiling, logs or replay). It is designed not to receive customer end-user data (evaluation records, end-user IP addresses or device identifiers), so we list it for transparency and have not treated it as a sub-processor that processes customer data under the 30-day advance-notice clause. The removal is pattern-based, a strong safeguard rather than a guarantee; anything it missed expires under Sentry’s retention (30 days on its free Developer plan; up to 90 days on paid plans and during a trial). Privacy Policy §2.1, §3 and §5, Cookie Policy §3 and §5, the trust page, the security whitepaper and the responsible-disclosure policy were updated in the same change. |
| 2026-09-23 | Added PostHog (product analytics and session recordings, PostHog EU Cloud) to this list and DPA Annex C (DPA version 1.8). It measures visits to maskbreak.com — public pages, /signup and the dashboard — from page load without a consent prompt; browsers sending Global Privacy Control or Do Not Track, or asking to save data, are not measured, and sign-in, reset, verification, invitation, settings, security, members, admin and result pages never load it. Form fields, the visitor’s own network readouts and all dashboard text are masked before anything is sent. It processes our own website and account holders’ usage as controller and is not supplied with customer API or evaluation records, so the 30-day advance-notice clause for data-processing sub-processors does not apply. Privacy Policy §2.1 and §5, Cookie Policy §2.3, §2.5, §3 and §5, the trust page and the security whitepaper were updated in the same change. |
| 2026-09-23 | Removed Upstash from DPA Annex C (DPA version 1.7). The application has not sent it any data since 2026-09-06 (see that entry), and the short-lived keys written before then have expired. |
| 2026-09-22 | Widgo chat now loads automatically on public marketing pages instead of behind a per-page consent notice, so the same public visit data reaches Widgo from page load rather than from a click. Nothing changed for sign-in, private account or result pages (no widget), for customer API or evaluation records (never supplied), or for session replay (still disabled). Browsers sending Global Privacy Control get a plain “Chat” button and Widgo loads only when it is pressed. Privacy Policy §4 and §5, Cookie Policy §2.4, the trust page and the security whitepaper were updated in the same change. |
| 2026-09-08 | Replaced new Crisp chat with consent-gated Widgo AI chat on reviewed public marketing pages. Replay is disabled; private/account pages offer email support. Widgo receives consenting visitors’ chat and visit data, not customer API/evaluation records. Historical Crisp support records are preserved. Updated privacy, cookies, DPA Annex C and security disclosures. This optional website service is distinct from processing customer end-user evaluations. |
| 2026-09-06 | Moved abuse-sensitive rate limits and email-send budgets into the existing application database using keyed hashes. The application no longer sends rate-limit keys to Upstash; previously written keys remain subject to their existing short expiry. No new sub-processor was added. Updated the Privacy Policy with the security records and cleanup schedule. |
| 2026-09-06 | Removed Google Ads measurement from public pages, signup, the dashboard, and shared page generators. Google Sign-In remains available. Corrected the current privacy, cookie, and security notices; earlier dated entries below describe historical use, not the current setup. Clarified same-tab chat continuation. No new sub-processor was introduced. |
| 2026-09-04 | Added Crisp (live chat). The chat button on every page loads nothing until it is clicked; from that click Crisp receives what the person types plus their IP address, browser details and current page. It never touches customer API or evaluation data, so the 30-day advance-notice clause for data-processing sub-processors does not apply. Privacy Policy §5 and Cookie Policy §2.4 and §3 were updated in the same change. |
| 2026-09-02 | Added Auth0 (emailed one-time sign-in link, where offered). The integration shipped on 2026-09-01 behind configuration, like GitHub Sign-In: Auth0 receives the account holder’s email address only when the option is enabled and used, and nothing otherwise. Completeness correction — the code landed before this list was updated. |
| 2026-08-29 | Clarified two rows without adding or removing anyone. GitHub: the sign-in integration exists in the codebase but no GitHub OAuth app is configured in production, so the option is not shown and GitHub receives no data; it stays on the list so that notice has already been given if it is enabled. Google: the row now also names the cookieless Google Ads measurement tag (Consent Mode v2, all storage denied) that public pages and the signed-in dashboard have loaded since 2026-07-19 and that Privacy Policy §5 and Cookie Policy §2.3 already disclose. The Privacy Policy, Cookie Policy, Terms, DPA and security whitepaper were corrected and re-dated in the same change. |
| 2026-08-02 | Added and removed Dreamdata (business-to-business marketing attribution) on the same day. It was live on public marketing pages for approximately 30 minutes. During that window its account-level component sent page URL, page title, canonical URL, referring URL and the requesting IP address to Dreamdata, which uses them to estimate the organisation a visit came from. Its visitor-level component was gated behind analytics consent, which this site does not grant — with one exception we want to be explicit about: the gate is read from Google’s consent framework, so a visitor whose browser blocked Google Tag Manager would have had the visitor-level component, including form tracking, initialise normally. It never ran on the console or on any signed-in page, and it received no customer API or evaluation data at any point. It has been fully removed; no Dreamdata code, endpoint or Content-Security-Policy entry remains. Recorded here for completeness rather than because any obligation attaches to a provider that is no longer used. |
| 2026-07-19 | Added GitHub (Sign-In only, OAuth) — an optional “Sign in with GitHub” for Maskbreak accounts. It touches only the account holder’s own OAuth identity assertion, never customer end-user evaluation data, so the 30-day advance-notice clause for data-processing sub-processors does not apply. Privacy Policy §5 and Cookie Policy §3 were updated in the same change. |
| 2026-07-18 | Added Upstash (rate-limit state) and Amazon Web Services / S3 (encrypted nightly backups). Both were already live infrastructure — this is a completeness correction to the published list, not a new-processor onboarding, so the 30-day advance-notice clause does not apply. Privacy Policy §5 and the security whitepaper were updated in the same change. |
| 2026-07-16 | Page published. List matches the sub-processors already disclosed in the Privacy Policy — no additions or removals. |
Getting notified
Sub-processor change notices are given by a dated entry in the change log above, at least 30 days before a new sub-processor that processes customer data goes live. Watch this page for them; changes are also summarised in the changelog.
Questions or objections: support@maskbreak.com.