Effective / last updated: July 8, 2026
Saluca LLC engages the third-party sub-processors below to help provide the hosted Services (Asphodel and the PEP-configuration add-on). This page is referenced by our Privacy Policy and Data Processing Agreement.
Self-hosted Tiresias. Tiresias runs on the customer's own infrastructure. Saluca does not receive or process the customer's governed data, so no Saluca sub-processor touches it. The only exception is the optional, opt-in Enterprise/MSSP central control-plane and signed-audit shipping, which is hosted on the infrastructure below.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Cloud hosting, compute, storage, managed database | Account identifiers, content submitted to the hosted surfaces only (Mindsets, Council, hosted Asphodel tenancies), usage and audit logs. Nothing from the self-hosted products reaches us. | United States — us-central1 primary, us-west2 backups. Encrypted backups also replicated to europe-west9 (Paris, France) and deleted after 365 days. |
| Stripe, Inc. | Payment processing & subscription billing | Billing contact and Stripe customer/subscription identifiers (Stripe holds payment-card data; Saluca does not store it) | United States |
| Google LLC (identity) | Authentication — OpenID Connect sign-in | Account email address and the email_verified claim |
United States |
| Resend | Transactional email (receipts, license/onboarding, security notices) | Recipient email address and message content | United States |
| Cloudflare, Inc. | DNS, CDN, WAF, bot mitigation, and the edge compute and databases behind Mindsets | IP address, request metadata, workspace and entitlement records. Query text is not retained. | Databases primaried in Western North America (United States). Requests are handled at the network location nearest the requester, which may be outside the United States. |
| Supabase (marketing website only) | Website waitlist / leads database | Lead email and submitted form fields | United States |
Saluca will provide at least 30 days' advance notice before adding or replacing a sub-processor that processes personal data, by updating this page and notifying customers who subscribe to updates. Customers may object as described in the Data Processing Agreement.
Questions about our sub-processors: privacy@saluca.com.