Trust
Subprocessor Register
This register identifies third parties SONARmetrics engages to help deliver the service where they may process personal data on our behalf.
Current subprocessors
| Provider | Service and data | Processing footprint |
|---|---|---|
| Hetzner Online GmbH | Primary application and database infrastructure Customer workspace content, account identifiers, encrypted connector credentials, logs, and backups hosted by SONARmetrics. | European Union deployment region selected by SONARmetrics; limited provider support and subprocessors as described in Hetzner’s DPA. |
| Supabase, Inc. and relevant affiliates | Authentication and identity infrastructure Account identifiers, email address, authentication identities, session and account-security metadata. | Configured Supabase project region, with support and onward processing described in Supabase’s DPA and subprocessor list. |
| Vercel Inc. | Public website and application frontend delivery Web requests, IP address, user-agent and operational delivery logs; authenticated API data remains on SONARmetrics backend infrastructure. | Globally distributed edge network and provider processing locations listed by Vercel. |
| Cloudflare, Inc. and affiliates | DNS, network security, abuse prevention, and human-verification services IP address, browser/device signals, requested host and path, and security-risk signals. | Cloudflare’s global network, subject to the configured service and data-localization controls. |
| Google LLC / Google Ireland Limited | Google Workspace transactional and support email Recipient and sender addresses, message metadata, and the content of account, security, support, or notification emails. | Google Workspace infrastructure and support locations described in Google’s DPA and subprocessor register. |
| OpenAI, LLC / OpenAI Ireland Limited | User-invoked SonoAI features The prompt and minimum workspace context submitted for the specific AI request; connector credentials are not intentionally provided. | OpenAI API infrastructure and processing locations in OpenAI’s current subprocessor list. |
Exact regions and onward providers can change as each provider updates its infrastructure. Their then-current contractual subprocessor lists control those details; SONARmetrics reviews those notices and this register at least quarterly and whenever a material service-provider change is proposed.
Customer-directed integrations
Commerce, advertising, fulfillment, and notification services that an organization chooses to connect—such as Shopify, WooCommerce, Meta, TikTok, Google Ads, Slack, Discord, or a warehouse provider—act on that organization’s instructions. They are not engaged by SONARmetrics as general infrastructure subprocessors merely because a customer enables a connector. The customer remains responsible for its relationship, permissions, and lawful use of those services.
Changes and objections
We will update this page before a new material subprocessor begins routine processing where practicable and provide any additional notice required by an applicable DPA. Customers with a reasonable data-protection objection should email privacy@sonarmetrics.io promptly so we can assess available mitigations and contractual options.
Change history: 17 August 2026 — initial public register.