Legal
Sub-processors
The service providers FastMonitor uses to process personal data, what each receives and where.
Version 0.1 (draft) · Draft dated
Draft, pending legal review. This list is taken from the providers the code uses today; it is being reviewed before it takes effect.
1. Sub-processors
These providers process personal data for FastMonitor. Each receives only what it needs for the purpose shown.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe | Payments, subscriptions, invoices and the billing portal (Stripe Checkout) | Billing email and name, Stripe customer and subscription IDs, invoice records. Card details go to Stripe only; FastMonitor never receives them. | United States and the EEA | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| Amazon Web Services (Simple Email Service) | Sending system email: verification, password reset, invitations, alerts and reports | Recipient email address and name, and the message | The AWS region set by AWS_SES_REGION (us-east-1 in the example configuration) | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| PostHog (EU cloud) | Website analytics after you accept them, and a fixed list of server-side product events | A pseudonymous ID, pages viewed and clicks (website, after consent); account ID with event names such as monitor_created (server side, no URLs, emails or keys) | European Union (eu.i.posthog.com) | UK adequacy regulations (EEA) |
| reCAPTCHA v3 bot protection on the sign-in and sign-up pages, and Google sign-in if you choose it | Device and interaction signals on the auth pages; your Google name, email and avatar if you sign in with Google | United States | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms | |
| GitHub | GitHub sign-in if you choose it | Your GitHub name, email and avatar | United States | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| Sentry | Error reports, when error reporting is switched on | Error details and the page or endpoint, with query strings, cookies, auth headers and request bodies removed; no session replay | The data region of the Sentry project (United States by default) | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| Vercel | Hosting the website and its sign-in pages | Request logs (IP address, user agent, page) and the pages you load | London, United Kingdom (lhr1); Vercel Inc. is a US company | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| OpenAI or Anthropic (one, by configuration) | AI diagnosis of an issue, on the Enterprise plan, when you ask for it | A redacted summary of the issue: the monitor's host name (not the full URL), recent result codes and timings, and the issue timeline. No API keys, headers, request bodies or alert recipients. | United States | UK International Data Transfer Addendum or the UK-US data bridge, under the provider's data processing terms |
| Database and API hosting | Storing account, monitoring and billing data and running the API | All the data described in the Privacy Policy | The provider and region are confirmed before launch (decision 6). The website's sign-in database uses the Neon serverless driver. | Stated on this page when the provider is confirmed |
2. Destinations you configure
When you connect one of these for alerts or automations, where your plan includes it, we send it the alert or event you set up:
- Slack
- PagerDuty
- Microsoft Teams
- Discord
- Google Chat
- Telegram
- Opsgenie
- Splunk On-Call
- Lark
- Webhooks
- n8n
They receive data on your instruction and under their own terms; they are not our sub-processors.
3. Changes to this list
We announce a new or replaced sub-processor on this page 30 days before it starts processing personal data. Customers can object under the Data Processing Agreement. The Privacy Policy explains how we use personal data.