Trust
Subprocessors & data processing
Who else touches Signal9 data, what they touch, and how to raise a data-processing request. Confirm this list against your own procurement requirements before signing.
Current subprocessors
| Provider | Purpose | Data handled |
|---|---|---|
| Vercel | Hosting, build and delivery of the Signal9 web app. | Request metadata (IP address, user agent, route) needed to serve the app. |
| Fly.io | Backend application servers, the managed Postgres database, and the live lab environments. | Account records, progress, lab and screening data, roles, billing records, and diagnostic events. |
| Stripe | Payment processing and subscription billing. | Billing details and payment card data entered directly with Stripe (Signal9 does not store card numbers), plus customer and subscription identifiers. |
| Resend | Transactional email delivery (welcome, invites, magic-link sign-in, certificates, security notices). | Recipient name and email address, message content. |
| Cloudflare | DNS for signal9.sh — domain resolution and sending-domain verification. | Public DNS lookups. No customer data. |
Payment card details are entered directly with Stripe and handled under their PCI DSS compliance; Signal9 does not receive or store full card numbers.
Controller and processor roles
For individual learner accounts, Signal9 is the controller of the account and progress data it holds. For team and enterprise workspaces, the customer is the controller of their members' data and Signal9 acts as processor, handling that data only to provide the service and on the customer's instructions.
International transfers
Our providers operate globally, so data may be processed outside your country. Where a transfer mechanism is required, it is covered by the provider's own contractual terms. Tell us your regional requirements before rollout and we'll confirm what we can support.
Data-processing requests
Export and deletion of your own data are available from account settings. For workspace-wide requests, a data-processing agreement, or notice of subprocessor changes, email privacy@signal9.sh. We aim to respond within five business days.