A subprocessor is a third party that Smartplane engages to process customer data, meaning the personal data in an organisation’s Smartplane account, on the organisation’s behalf. This page lists every subprocessor we use today. It forms part of our Privacy Policy and of any data processing agreement we sign with a customer.
Current subprocessors
| Subprocessor | What it does for Smartplane | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosts and runs the whole service: the website, dashboard, API and MCP gateway (Workers), the database (D1), caches (KV), skill files and the audit archive (R2), event queues (Queues), the per-organisation audit writer and rate limiters (Durable Objects), AI inference for guard rules (Workers AI), and operational logs (Workers Logs) | All customer data, including encrypted secrets and the audit log | Global network; United States and other countries where Cloudflare operates |
| WorkOS, Inc. | Sign-in (AuthKit), single sign-on, directory sync (SCIM), organisations, invitation emails and the admin portal for SSO and directory setup | Members’ names, email addresses, organisation memberships and directory attributes | United States |
Each provider’s own terms: Cloudflare’s privacy policy, customer data processing addendum, subprocessors and Workers AI data usage; WorkOS’s privacy policy and data processing addendum.
What is not a subprocessor
Services your organisation connects. When your organisation connects an MCP server, an API, a database or an integration such as GitHub, Slack or Google Workspace, your agents’ calls go to that service with the credentials your organisation provided. Your organisation chooses those services and has its own relationship with them, so they are not Smartplane’s subprocessors. Their own terms apply.
Open-source code that runs inside Smartplane. Smartplane’s integrations are built on open-source Activepieces pieces, which run inside Smartplane’s own Cloudflare Workers. Activepieces does not receive your data.
Observability. We do not currently send traces or logs to any provider other than Cloudflare. If we add one, it will appear in the table above before it receives any data.
Our own business tools
For data we control rather than process for customers, such as emails you send us, we use providers of our own. Email sent to our @smartplane.dev addresses is received through Cloudflare Email Routing and forwarded to our team’s mailbox.
Changes to this list
We review this list whenever we add or replace a provider. Before a new subprocessor starts processing customer data, we update this page and the date at the top. Customers with a signed data processing agreement are also told by email at least 30 days in advance and can object as that agreement provides. To ask about a subprocessor, or to be told about changes, write to privacy@smartplane.dev.