NOCTRA

Subprocessors used for Workspace processing

Version
1.2-rc.1
Effective date
Not assigned
Last updated
2026-10-16

Related documents

Summary

This disclosure identifies current providers that can process customer personal data on behalf of NOCTRA for Workspace services. It is scoped to the Workspace processor relationship; public marketing services are not included as Workspace subprocessors.

Full terms

Provider entity, region, transfer mechanism, provider DPA date and change date remain unpublished unless verified from the applicable contract or configuration.

Subprocessor change process

Before adding or replacing a Workspace subprocessor, NOCTRA provides notice through the applicable contract or billing contact or a designated Platform notice channel with enough advance time, where practicable, for an objection on objectively justified data-protection grounds. The parties first seek a reasonable solution where practicable. Urgent security, legal or provider circumstances may require shorter notice.

A. Workspace subprocessors

Services used to process customer-controlled Workspace data on NOCTRA’s behalf. Account-specific contract and transfer facts remain subject to the applicable provider account and agreement.

  1. Supabase

    The NOCTRA organization confirms automatic incorporation of its standard DPA, dated 1 August 2026. Separately negotiated older agreements may remain applicable.

    Provider reference
    Current classification
    Workspace subprocessor
    Activation
    Platform service
    Processing purpose
    Authentication, relational data storage, guarded database operations and file storage.
    Relevant NOCTRA functionality
    Supabase Auth; Workspace and Event application data; RPC and RLS enforcement; organizer branding and Event-cover storage; private storage of separately encrypted backup archives with seven-day retention.
    Potential data categories
    Account, Workspace, organizer, Event, attendee, buyer, ticket, Door, report, tax-document, audit and media data.
    Contracting provider entity
    Supabase Pte. Ltd.
    Processing region / location
    Production database and Storage: Ireland (eu-west-1); QA: Frankfurt (eu-central-1). Provider support and operational data are not exclusively EU-located.
    Transfer mechanism
    Provider DPA and EU Standard Contractual Clauses where required
    Provider DPA date
    2026-08-01
    Provider change type
    Current inventory
    Change date
    Not verified in repository
    Effective date
    Not verified in repository
    Notification status
    Current inventory — no change notification recorded
    Customer objection mechanism
    Not verified in repository

  2. Vercel

    The DPA is incorporated through the existing NOCTRA Pro customer agreement. Runtime logs are retained for 30 days in the verified Observability Plus account; no additional log drains are configured.

    Provider reference
    Current classification
    Workspace subprocessor
    Activation
    Platform service
    Processing purpose
    Application hosting, request delivery and server runtime execution.
    Relevant NOCTRA functionality
    Public website, protected application routes, API routes and server-rendered Workspace functionality.
    Potential data categories
    Request and device metadata and application data processed by invoked server routes.
    Contracting provider entity
    Vercel Inc.
    Processing region / location
    Application functions: Ireland (dub1). Further hosting, network, support and operational processing may occur in the United States and other countries.
    Transfer mechanism
    Provider DPA and applicable EU Standard Contractual Clauses
    Provider DPA date
    Not verified in repository
    Provider change type
    Current inventory
    Change date
    Not verified in repository
    Effective date
    Not verified in repository
    Notification status
    Current inventory — no change notification recorded
    Customer objection mechanism
    Not verified in repository

  3. Resend

    The pre-signed DPA available in the NOCTRA team applies from signup according to the provider. Emails/logs: 30 days; provider backups: 7 days; remaining customer data after account termination: up to 90 days. Marketing tracking is not enabled on the verified sending domain.

    Provider reference
    Current classification
    Workspace subprocessor
    Activation
    Only when the relevant feature is used
    Processing purpose
    Server-side delivery of transactional invitations, access messages, tickets and contract confirmations.
    Relevant NOCTRA functionality
    Transactional email delivery and related delivery-attempt handling; no Resend browser script is used.
    Potential data categories
    Buyer name and email, Event and ticket details, protected reservation link, provider message reference and delivery metadata.
    Contracting provider entity
    Plus Five Five, Inc.
    Processing region / location
    Sending region: Ireland (eu-west-1); email content and logs are also stored in the United States.
    Transfer mechanism
    Provider DPA, EU Standard Contractual Clauses and applicable adequacy safeguards
    Provider DPA date
    Not verified in repository
    Provider change type
    Current inventory
    Change date
    Not verified in repository
    Effective date
    Not verified in repository
    Notification status
    Current inventory — no change notification recorded
    Customer objection mechanism
    Not verified in repository

  4. Upstash Redis

    The standard terms expressly incorporate the DPA. Customer daily backups are disabled. Limiter analytics is off; reviewed limiter buckets have a maximum TTL of 48 hours plus one second. This does not describe every Redis key or provider-internal backup.

    Provider reference
    Current classification
    Workspace subprocessor
    Activation
    Only when the relevant feature is used
    Processing purpose
    Server-side rate limiting for selected reservation and refund operations.
    Relevant NOCTRA functionality
    Abuse and availability protection using route or Event scopes; Upstash limiter analytics is disabled.
    Potential data categories
    HMAC-derived pseudonymized request-origin signal, Event or route scope, counters and reset metadata.
    Contracting provider entity
    Upstash, Inc.
    Processing region / location
    Verified Free Redis database: Frankfurt (eu-central-1), no additional read region configured. Provider-internal processing is not promised to be exclusively EU-based.
    Transfer mechanism
    Provider DPA and EU Standard Contractual Clauses where applicable
    Provider DPA date
    Not verified in repository
    Provider change type
    Current inventory
    Change date
    Not verified in repository
    Effective date
    Not verified in repository
    Notification status
    Current inventory — no change notification recorded
    Customer objection mechanism
    Not verified in repository

B. Payment providers and mixed or independent roles

Payment services can perform different legal roles across Connect, checkout, payment, refund and compliance activities. No single role is forced across all processing.

  1. Stripe

    Payment and Connect activities may involve processor and independent or separate-controller roles. No single classification is asserted until the actual Stripe contracts and data flows are reviewed.

    Provider reference
    Current classification
    Pending legal classification
    Activation
    Only when the relevant feature is used
    Processing purpose
    SaaS subscription billing, Stripe Connect organizer onboarding, hosted ticket checkout, payment processing and refunds.
    Relevant NOCTRA functionality
    Platform subscription billing, connected organizer payment accounts, hosted buyer payment surfaces, server payment API and verified Connect webhooks.
    Potential data categories
    Organizer payment-account information; buyer contact and billing data; order, checkout, payment and refund references and amounts.
    Contracting provider entity
    Not verified in repository
    Processing region / location
    Not verified in repository
    Transfer mechanism
    Not verified in repository
    Provider DPA date
    Not verified in repository
    Provider change type
    Current inventory
    Change date
    Not verified in repository
    Effective date
    Not verified in repository
    Notification status
    Current inventory — no change notification recorded
    Customer objection mechanism
    Not verified in repository
Back to NOCTRA