Sub-processors

Enlist uses the following providers to process the signups it holds on customers' behalf. This list is Appendix B to the data processing agreement. We email customers at least 30 days before we add or replace a sub-processor so they can object, see the data processing agreement.

#Vercel

• Purpose: hosting of the API, dashboard and site, server functions and operational logs.
• Entity: Vercel Inc., USA.
• Location: server functions run in Washington, D.C., USA (iad1). Static files and requests pass through Vercel's global network.
• Transfer basis: the EU-U.S. Data Privacy Framework (Vercel is certified) and the European Commission's standard contractual clauses, under Vercel's data processing addendum. Enlist is on Vercel's Pro plan, which the addendum covers.
• Source: vercel.com/legal/dpa, vercel.com/docs/functions/regions, vercel.com/kb/guide/is-vercel-certified-under-dpf

#Neon

• Purpose: the PostgreSQL database holding all waitlists, signups, accounts and settings, including backups.
• Entity: Neon, LLC (part of Databricks, Inc.), USA.
• Location: AWS US East 1 (N. Virginia), USA.
• Transfer basis: the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses, under Neon's data processing addendum.
• Source: neon.com/dpa, neon.com/docs/security/security-overview, neon.com/docs/introduction/history-window

#Resend

• Purpose: sending signup emails for customers who use Enlist's own email sending (the "Enlist" email provider), receiving their delivery events, and sending account emails to customers.
• Entity: Resend (Plus Five Five, Inc.), USA.
• Location: USA. Emails may be sent from the USA. Account data, email metadata and logs are stored in the USA whatever the region.
• Transfer basis: the EU-U.S. Data Privacy Framework (Resend is certified) and the European Commission's standard contractual clauses (Modules Two and Three), under Resend's data processing addendum.
• Source: resend.com/docs/dashboard/domains/regions, resend.com/changelog/data-privacy-framework-certification, resend.com/legal/dpa

#Not sub-processors

#Integrations you connect

A customer can have Enlist send its signups' data to services the customer chooses and contracts with itself:

• Outbound webhooks to a URL the customer sets.
• Slack and Discord, through a webhook URL from the customer's own workspace or server.
• Loops, Kit and PostHog, with the customer's own API key. For PostHog the customer chooses the host, for example its EU or US cloud.
• The customer's own Resend account, when the customer sends signup emails on its own key instead of Enlist's.

Enlist sends these services the event the customer subscribed to, such as a new signup with its email address, position, referral details, custom fields and metadata. Sending is an instruction from the customer, and these services are not Enlist's sub-processors: the customer's own agreement with each service applies, and the customer decides whether it is the customer's processor. Enlist stores the customer's credentials for them encrypted.

#GitHub (sign-in)

Customers sign in to the dashboard with their GitHub account. GitHub receives no signup data and only processes the account holder's own sign-in, as an independent controller under its own privacy statement. See docs.github.com/site-policy/privacy-policies/github-general-privacy-statement.

#Stripe (billing)

Paid plans are billed through Stripe. Stripe receives the account holder's email address and Enlist account ID, and the card details the account holder enters on Stripe's own checkout page. It receives no signup data. See stripe.com/privacy.

#Changes

Changes to this list are reflected in the date at the top.