PRELAUNCH LEGAL DRAFT
Subprocessors
The service providers that process personal data for TOVIO Cloud and the TOVIO websites, and how this list changes.
Last updated September 24, 2026
Prelaunch legal draft - not effective. This repository text is not counsel-approved, does not create an agreement, and cannot enable production checkout. The effective version must be separately approved, versioned, and recorded in the release-status manifest.
At a glance
- Two lists: providers that process Customer Personal Data on your behalf under our Data processing addendum, and providers that process data Tovio, LLC controls under our Privacy policy.
- Changes: When we add a subprocessor, we update this page. We do not give advance notice of changes.
- Status: TOVIO Cloud is not generally available and production checkout is not open. This list describes the providers the hosted service and the websites are built on.
1. Subprocessors for Customer Personal Data
These providers process Customer Personal Data, as defined in our Data processing addendum, when we provide TOVIO Cloud to you.
| Provider | What it does | Personal data involved |
|---|---|---|
| Cloudflare | Hosts TOVIO Cloud: handles requests, stores repository objects and service data, and provides edge security and access control. Repository objects are stored in buckets created with a location hint for eastern North America; requests are handled on Cloudflare's global network. | Repository content and history, AI session transcripts, organization membership, directory-sync and webhook data, and the network data of requests. Content in policy-protected paths is stored encrypted. |
| PostHog | Stores the server logs, error reports, performance metrics and request traces the hosted service's Workers export, in the United States or the European Union depending on the region configured. | The log lines the hosted service writes while handling requests; reports of errors it caught — the kind of error, its message, and where in the service it was caught; request timings and counts by type of request; and request traces — how long each step of a request took, with the request's address and the approximate location and browser details Cloudflare derives from it. A request identifier joins them, and for a request from the dashboard, the dashboard's random session identifier. No repository content. |
| WorkOS | Enterprise directory sync, only for enterprise customers who enable it. | Directory records received from the customer's identity directory. |
2. Service providers for data Tovio controls
These providers process personal data that Tovio, LLC holds as a controller, as described in our Privacy policy.
| Provider | What it does | Personal data involved |
|---|---|---|
| Cloudflare | DNS, content delivery, and edge security for tovio.dev and docs.tovio.dev, cookieless web analytics, and the country lookup used to apply cookie-consent rules. | Traffic metadata such as network address, requested page, and browser details. |
| Stripe | Payments, invoicing, tax and customer details, and subscription metering. | Billing identity, payment details, agreement records, subscription state, and usage quantities; no repository content. |
| Google Analytics 4 for aggregate traffic and content analytics on tovio.dev and docs.tovio.dev, for visitors who accept analytics cookies or who have not opted out where opt-out applies; Google Workspace email for our privacy@ and security@ mailboxes; and Google sign-in. | Public-site page views, referrers, approximate location derived from network address, device and browser characteristics, and a first-party analytics cookie identifier; the contents of email sent to those mailboxes; and sign-in identifiers. | |
| Apple | Sign in with Apple. | Sign-in identifiers. |
| PostHog | Browser monitoring — page views, page timings, and client-side error reports — on tovio.dev and docs.tovio.dev under the same consent decision as analytics, and on the logged-in dashboard, where it runs without a separate consent prompt. Session replay runs on tovio.dev marketing and policy pages, and on the signed-in dashboard; it is off on the repository explorer and on docs.tovio.dev. On the dashboard it is masked default-deny in the browser: text is replaced with asterisks unless it is one of our own interface labels, link addresses, tooltips and form values are removed, and repository content — file contents, diffs, job logs, code editors and key material — is excluded from the recording rather than masked within it. Operators can switch recording off per device. Automatic interaction capture is off everywhere. A named set of events records, on the public sites, which homepage message was shown and which links and buttons were used; and on the dashboard, which type of screen was opened, which actions were completed, how sign-in and checkout went, and whether the Forge answered — and, as timings aggregated by type of request, how long it took. | Page address, referrer, approximate location derived from network address, device and browser characteristics, and error details, keyed to a monitoring identifier kept in the browser's local storage. Where session replay runs, also a reconstruction of the rendered page and of pointer, scroll, and click movement, with the values of any input masked before the recording leaves the browser. On the dashboard a recording carries page structure, interface labels and interaction only: text is masked and repository content is excluded in the browser, so what is hidden is never transmitted rather than transmitted and then hidden. Text lengths, element sizes and the change graph's shape remain visible. On the dashboard, screens are recorded as route templates rather than addresses, and query strings and fragments are removed before an event is sent, so a repository name is not part of what is sent. Each event also carries an identifier for the build of the dashboard that sent it. No account, billing, or repository content. |
| Better Stack | Independent monitoring, incident response, and the public status page. | Service health data, bounded diagnostics, responder records, and the contact details of people who subscribe to status updates. |
| Featurebase (CORDNET OÜ, Estonia; EEA hosting) | The feedback portal, public roadmap, product-update notices, help center, and support form at feedback.tovio.dev, help.tovio.dev, and support.tovio.dev, including AI-assisted duplicate detection, reply drafting, and help-center answers. | Content visitors choose to submit (posts, votes, comments, tickets), the sign-in identity they choose for that portal, the optional update-subscription email, and the portal's own traffic metadata. For the AI features, that content is processed by Featurebase's own AI subprocessors. No TOVIO Cloud account, billing, or repository content. |
| Linear | Internal engineering issue tracker. | A paraphrased title and a link for feedback posts an operator chooses to push; no portal identity or email. |
| GitHub | Hosting of TOVIO software release downloads. | The network data of download requests. |
3. Providers you choose
Identity providers you connect for enterprise single sign-on, AI model providers you configure with your own API key, and webhook endpoints you add are chosen and contracted by you. They are not Tovio's subprocessors.
4. Changes to this list
When we add a subprocessor, we update this page, as described in Section 7 of our Data processing addendum. We do not give advance notice of changes. The date at the top of this page shows when it was last updated.
5. Contact
Questions about this list go to privacy@tovio.dev.