Subprocessors
Last updated October 26, 2026
Draft: this document hasn't been reviewed by counsel yet and isn't in force. It describes how the service works today; the final version will replace it.
These companies process customer data on our behalf to run Underpass. Each is bound by a contract that limits it to that work and requires it to protect the data.
| Company | What it does for us | Data | Location |
|---|---|---|---|
| Supabase | Sign-in (including sending sign-in codes), and the database behind accounts, workspaces, members and billing | Account and workspace data | [Region of the Supabase project] |
| [Hosting provider for the dashboard] | Runs the dashboard and this website | Account data in transit, request logs | [Region] |
| Hetzner Online | Runs the coordination service, the relay and STUN | Device data, audit and network logs; relayed traffic, which stays end-to-end encrypted | [Hetzner region, e.g. Germany] |
| [Backup storage provider] | Stores encrypted backups of the coordination service | Encrypted device data and logs | [Region] |
| Anthropic | Answers the dashboard's support chat | Messages you type in the support chat | United States |
| Posthawk | Sends invite and approval emails, and delivers messages from our website's contact form | Email addresses, names and message content | [Region] |
| Let's Encrypt (ISRG) and Cloudflare | Issue HTTPS certificates for devices, when a workspace turns that on | Device names in the certificate | United States |
Not on this list
Google is used only if you choose to sign in with Google; it acts as your identity provider, not as our subprocessor. Services your workspace admins connect (webhooks, log streams such as Slack or Datadog) are chosen and controlled by your organization.
Changes
We'll update this page at least 30 days before a new subprocessor starts processing customer data, as set out in our Data Processing Addendum. To be told by email, write to privacy@getunderpass.com with the subject "Subprocessor updates".
Underpass is operated by Sukses360 Ltd · [Registered address]