Subprocessors
This page documents the systems Nexraft operates directly and the third-party subprocessors we engage to deliver hosting, billing, and client communications. We limit data shared to what each function requires, review providers for security posture, and contractually require appropriate safeguards where applicable.
Last updated: June 2026 · Document ID: LEG-SUB-001
Nexraft-operated systems
Nexraft managed edge network
Production delivery for nexraft.com and client sites: TLS termination, global edge caching, DDoS mitigation, automated deploys, and uptime monitoring. Data processed: Request metadata, cached static assets, deployment artifacts. No end-user account data stored at the edge. Region: United States primary; global edge PoPs.
Nexraft observability stack
First-party performance and availability metrics. Aggregated page views and Core Web Vitals. No advertising identifiers, no cross-site tracking. Data processed: Anonymized page paths, device class, load timing. IP addresses are not retained in analytics. Region: United States.
Third-party subprocessors
Stripe, Inc.
[Payments] Subscription billing, invoicing, and self-service customer portal for retainer clients. Data processed: Customer email, subscription status, payment method tokens. Card numbers are processed and stored by Stripe only. Region: United States; PCI DSS Level 1.
Supabase, Inc.
[Data sync] Webhook-driven sync of billing metadata from Stripe. Used for internal subscription state, not public-facing auth. Data processed: Stripe customer IDs, plan keys, subscription status, webhook event payloads. Region: United States.
Instantly (Instantly.ai)
[Sales intelligence] Website Visitors pixel: identifies U.S. visitors, enriches firmographic and contact data, and routes leads into Instantly for follow-up. Data processed: Page views, referrer, IP-derived company match, and U.S. contact signals where Instantly has a match. Powered by Apollo tracking infrastructure. Region: United States (visitor identification limited to U.S. traffic per Instantly).
Formspree, Inc.
[Communications] Contact form relay when configured. Delivers inquiry payloads to Nexraft inboxes. Data processed: Name, email, company, message body, and optional project brief fields submitted via the contact form. Region: United States.
Cal.com, Inc.
[Scheduling] Discovery call booking. Calendar availability and meeting confirmations. Data processed: Name, email, selected time slot, and optional intake notes provided at booking. Region: United States and EU (region selected at booking).
Client project vendors
Scope-specific services
Individual client builds may use additional providers (CMS platforms, email delivery, CRM integrations, CAD/asset pipelines) documented in the signed statement of work and client agreement. Those vendors are not listed here unless they process personal data on Nexraft's behalf under a retainer.
Change notification
Material additions or replacements to the third-party list above will be posted on this page with an updated date. Enterprise clients under a signed DPA may request advance notice and a current subprocessor register by email.
Data processing agreements
Nexraft maintains DPAs or equivalent contractual terms with subprocessors that handle personal data. Request a copy or our standard DPA template at barry@nexraft.com.
Related: Privacy policy, SLA summary, Terms of service.