Trust
Subprocessors & data processing
Who else touches Signal9 data, what they touch, and how to raise a data-processing request. Confirm this list against your own procurement requirements before signing.
Current subprocessors
| Provider | Purpose | Data handled |
|---|---|---|
| Vercel | Hosting, build and delivery of the Signal9 web app. | Request metadata (IP address, user agent, route) needed to serve the app. |
| Fly.io | Backend application servers, the managed Postgres database, and the live lab environments. | Account records, lab progress and results, write-ups, billing records, and server logs. |
| Stripe | Payment processing and subscription billing. | Billing details and payment card data entered directly with Stripe (Signal9 does not store card numbers), plus customer and subscription identifiers. |
| Resend | Email delivery: account email (welcome, invites, magic-link sign-in, certificates, security notices) and reminder emails for learners who opt in. | Recipient name and email address, message content. |
| Optional "Sign in with Google". | Your name, email and Google account ID. | |
| GitHub | Optional "Sign in with GitHub". | Your GitHub username, email and account ID. |
| Sentry | Error reporting, when it is switched on: crashes in the web app (only if you accept diagnostics) and failures in the API server. | Error details and the page or request path. Browser reports are anonymous; API server reports can include your account ID. No passwords, cookies, request bodies or URL query strings. |
| Cloudflare | DNS for signal9.sh — domain resolution and sending-domain verification. | Public DNS lookups. No customer data. |
Payment card details are entered directly with Stripe and handled under their PCI DSS compliance; Signal9 does not receive or store full card numbers.
Controller and processor roles
For individual learner accounts, Signal9 is the controller of the account and progress data it holds. For team and enterprise workspaces, the customer is the controller of their members' data and Signal9 acts as processor, handling that data only to provide the service and on the customer's instructions.
International transfers
Our providers operate globally, so data may be processed outside your country. Where a transfer mechanism is required, it is covered by the provider's own contractual terms. Tell us your regional requirements before rollout and we'll confirm what we can support.
Data-processing requests
Export and deletion of your own data are available from account settings. For workspace-wide requests, a data-processing agreement, or notice of subprocessor changes, email privacy@signal9.sh. We aim to respond within five business days.