Subprocessor Notice
Effective date: August 12, 2026
Last updated: September 19, 2026
This notice identifies third parties that may process personal data on MemStrata’s behalf for the hosted Services. A provider is used only for the listed purpose and only when the related feature is enabled.
Current providers
Section titled “Current providers”| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | DNS, traffic security, hosted licensing, OAuth callbacks, and service storage | Request/security metadata; account, license, pseudonymous device, audit, and entitlement data |
| Stripe | Checkout, subscriptions, invoices, tax and payment administration | Contact, billing, transaction, subscription, and fraud-prevention data |
| GitHub | Optional GitHub OAuth and software release/CI infrastructure | OAuth subject and email when selected; repository and release metadata |
| Optional Google OAuth | OAuth subject, email, profile, and authentication events when selected | |
| Vercel | Public website hosting | IP address, user agent, requested URL, and necessary security metadata |
| Plausible | Website analytics on memstrata.dev | Page URL and necessary request metadata; no marketing pixels |
Payment networks, app stores, package registries, and marketplace operators may act as independent controllers under their own notices when a customer uses their channel.
Location and transfers
Section titled “Location and transfers”Providers may process data in Canada, the United States, and other locations listed in their applicable service and subprocessor documentation. Where required, MemStrata uses contractual or other lawful transfer safeguards.
Changes
Section titled “Changes”We will update this page before adding a new material subprocessor for hosted Customer Data. Enterprise customers may request advance change notice in an Order Form or executed DPA and may raise a documented data-protection objection.
Questions may be sent to privacy@memstrata.dev.