Subprocessors
Every third party that touches your data, what it does, and what it receives. This page forms Annex III of the data processing addendum.
These providers are involved in running ShellOrbit. Each does one job, each is bound by a written agreement with confidentiality and security obligations, and none may use your data for its own purposes. This page forms Annex III of the data processing addendum.
Changes in version 1.6. No provider is added or replaced. The descriptions now cover security events from your sources, the findings raised from them, and the hostnames the SDK reports, in place of webhook delivery. This version applies to accounts created from 25 October 2026 at once, and to every other account from 24 November 2026; until then the previous version applies to them.
Changes in version 1.5. Cloudflare (Turnstile) is added, to check that a person rather than a script is using the sign up, sign in, emailed sign in, and password reset pages. It starts on 22 October 2026 and also checks the contact form on shellorbit.com, which now reaches Zoho CRM through ShellOrbit’s API. No other provider is added or replaced. This version also lists OSV.dev with the public advisory sources and names the providers you can connect yourself.
Changes in version 1.4. From 22 October 2026, Amazon Web Services also runs Incident Alerts, and GitHub repository scanning is withdrawn. No provider is added or replaced. See section 2.
Changes in version 1.3. From 19 October 2026, our previous email provider is no longer a subprocessor and every email we send goes through Amazon SES. Zoho Campaigns and Zoho Desk are new, and Zoho CRM gains a new purpose; they apply from the same date. See section 2.
1. Current subprocessors
| Provider | Purpose | Data it processes | Role |
|---|---|---|---|
| Amazon Web Services | Hosting in the US East (N. Virginia) region: compute, storage of source events, object storage for oversized events, queueing, rule processing, backups, logs, content delivery for the site and dashboard, and all transactional email through Amazon SES, sent from no-reply@shellorbit.com: sign in codes, finding alerts, weekly digests, security and billing notices. Also the Leak Alarm scanning of verified domains and log drains, the tripwire addresses, links, and fake AWS key endpoints, and Incident Alerts, which matches stack details against public security advisories | Account data and event data from your sources, including headers and bodies, which can carry account identifiers, email addresses, IP addresses, and approximate locations from the systems you connect, and the findings raised from them. For email, the recipient address, message content, and delivery metadata; alert emails reference source names and finding titles, and the details a rule matched, never whole event bodies. For Leak Alarm, findings with masked values, one way fingerprints, tripwire hit records including source IP address and user agent, and stack details (declared products and versions, SDK runtime versions, and certificate and server header details of verified domains), and the hostnames an SDK project's app connects to; page and log content is scanned and discarded, not stored | Infrastructure processor |
| WorkOS | Authentication, session issuance, single sign on where you use it | Email address, name where provided, authentication identifiers, session and login metadata, IP address | Processor for account data |
| Dodo Payments | Payment processing as merchant of record, tax collection and remittance, invoicing, subscription billing including metered usage | Billing name and email, country, payment instrument held by Dodo Payments, transaction and tax records, metered event counts we report for billing | Merchant of record and independent controller for payment data |
| Zoho Corporation, Zoho CRM | Handling enquiries sent through the contact form on shellorbit.com, which reach it through ShellOrbit's API, and the correspondence that follows. Also a record of each ShellOrbit account for account management. India data centre (zoho.in) | For enquiries: first and last name, email address, company, position where given, subject, and the message body you type. For account records: email address, name, sign in method, plan, billing cycle, monthly revenue, account and user ids, UTM source, medium and campaign, referring site, first page visited, signup date, last active date, and lifecycle stage. Nothing from your source events or Leak Alarm findings | Processor for enquiry and account data |
| Zoho Corporation, Zoho Campaigns | Product update email, sent only to people who ticked the marketing consent box and confirmed it. India data centre (zoho.in) | Email address, name, the consent record, subscription status, and the delivery and engagement data Zoho Campaigns records for each email | Processor for marketing data |
| Zoho Corporation, Zoho Desk | Support tickets created in the dashboard, and the email replies that follow. India data centre (zoho.in) | Contact email address and name, ticket subject and description, plan, account and user ids, ticket status and priority, and the correspondence on the ticket. Nothing from your source events unless you paste it in | Processor for support data |
| Functional Software, trading as Sentry | Error monitoring and performance tracing for the dashboard, the API, and the background workers, so a fault is found before you have to report it | Exception type and stack trace, the request path and method that failed, source and event identifiers, browser and operating system, IP address, and the account id of the person who hit the error | Processor for diagnostic data |
| Cloudflare, Turnstile | A check that a person, not a script, is using the sign up, sign in, emailed sign in, and password reset pages and the contact form on shellorbit.com, so accounts cannot be created, mail sent to strangers, or the contact form flooded in bulk | IP address, browser and device signals Cloudflare collects for the check, and the page and action the check ran on. Nothing from your source events or Leak Alarm findings | Processor for sign in and contact form security data |
Source event bodies reach only Amazon Web Services. The pages and log lines Leak Alarm scans are processed only on Amazon Web Services and are discarded once scanned; what is kept is a finding with a masked value such as sk_…a1b2. The stack details Incident Alerts matches are also processed only on Amazon Web Services. Authentication, email, payment, account management, marketing, support, and monitoring providers receive account level data, not the contents of your webhooks and not your findings.
Sentry deserves a specific statement, because error reporting is the usual way payload data leaks into a third party by accident. Request and response bodies are stripped before an event leaves our systems, headers named for authorization, cookies, or signatures are removed, and the scrubbing runs on our side rather than relying on Sentry’s own filters. What Sentry receives is the shape of a failure: which code path broke, on which endpoint id, for which account. If a payload fragment ever reaches it inside an exception message, that is a bug, and reporting it to security@shellorbit.com is welcome.
The contact form sends your enquiry to ShellOrbit’s API, which checks it with Cloudflare Turnstile and passes it straight on to Zoho CRM; nothing is stored or logged on our side. Sending it is your choice: every address on the contact page reaches us by ordinary email instead. Zoho CRM, Zoho Campaigns, and Zoho Desk run in Zoho’s India data centre.
Services you connect to ShellOrbit yourself are your own providers, not our subprocessors: a log platform; an AWS, OpenAI, Anthropic, Google Cloud, Azure, Twilio, SendGrid, or Supabase account you allow us to act in; GitHub’s and Hugging Face’s token revocation services and Google’s API key lookup when you turn them on; a revocation webhook you add; and the AI provider you add for explanations. We act in them only through the access you grant, and you can withdraw it at any time.
The public sources Incident Alerts downloads security advisories from, namely the Node.js release index, the Go vulnerability database, endoflife.date, the CISA Known Exploited Vulnerabilities catalog, Mozilla’s certificate revocation list, and OSV.dev’s export for the package registries, are not subprocessors. They receive no data about you or your stack; ShellOrbit only downloads from them.
2. Changes taking effect
| Change | Date | What it means |
|---|---|---|
| Previous email provider removed | 19 October 2026 | All transactional email is sent through Amazon SES. Removing a provider needs no notice period. |
| Zoho CRM, new purpose | 19 October 2026 | A record of each ShellOrbit account, as listed in the table above, in addition to contact form enquiries. |
| Zoho Campaigns added | 19 October 2026 | Product update email, only for people who opted in and confirmed. |
| Zoho Desk added | 19 October 2026 | Support tickets created in the dashboard, with replies by email. |
| Amazon Web Services, new purpose | 22 October 2026 | Incident Alerts runs on Amazon Web Services, inside the same account and region as the rest of the service. No new provider is involved. |
| GitHub repository scanning withdrawn | 22 October 2026 | ShellOrbit no longer reads GitHub repositories, and no repository content or commit author data is processed. |
| Cloudflare, Turnstile, added | 22 October 2026 | A check that a person, not a script, is using the sign up, sign in, emailed sign in, and password reset pages and the contact form on shellorbit.com. |
3. What is deliberately absent
- No advertising platform and no marketing analytics. Product update email goes only to people who opted in.
- No session recording or heatmap tool.
- No customer data platform, data broker, or enrichment service.
- No model training on source event content or on findings, by us or by anyone else.
- No third party error tracker with access to raw source events.
4. Notice of change
We give at least 30 days notice before adding or replacing a subprocessor. Notice goes by email to account holders and this page is updated on the same day. To receive notices at a different address, tell us at privacy@shellorbit.com.
Customers may object to a new subprocessor on reasonable data protection grounds within the notice period, under section 6 of the data processing addendum. If we cannot offer an alternative, you may terminate the affected part of the service and receive a pro rata refund of prepaid fees for the unused remainder of the term.
5. Questions
Write to privacy@shellorbit.com for a copy of the transfer mechanisms in place with any provider on this list, or for the audit and certification reports we are permitted to pass through.