Subprocessors
Last Updated: May 29, 2026
Encypher engages a limited set of third-party subprocessors to provide our Services. Each acts on Encypher's behalf under written terms that require confidentiality and security and restrict use of data to the purposes we specify. We provide advance notice before adding a new subprocessor so that customers may object.
To subscribe to subprocessor change notifications, email privacy@encypher.com. This page is referenced by our Privacy Policy and Terms of Service.
Current Subprocessors
| Subprocessor | Service provided | Categories of data processed |
|---|---|---|
| Railway | Application hosting and infrastructure | Service data stored in our database, application logs, performance metrics |
| Cloudflare | CDN, DNS, network security and DDoS mitigation | Connection and request metadata, IP addresses, security/traffic logs |
| Google Cloud | Cloud infrastructure and key management (KMS) | Cryptographic key material and key metadata; key management is engaged only where a customer enables personal-identity keys |
| Stripe | Payment processing and billing | Billing identity and organization details, payment and transaction status, transaction IDs (card data is held by Stripe; Encypher does not store card numbers) |
| Zoho | CRM, billing records, and transactional email (SMTP) | Account and contact details, billing records, email addresses, transactional email content |
| Google Analytics | Marketing-website analytics only | Online identifiers and usage events on our marketing website, loaded only after cookie consent; not used on the authenticated signing/verification Service |
Independent Parties (Not Subprocessors of Personal Data)
SSL.com is our Certificate Authority. It receives organization and certificate-request data to issue X.509 certificates and operates as an independent CA under its own Certificate Policy and Certification Practice Statement, rather than as a subprocessor acting on Encypher's instructions. It does not process customer personal data on Encypher's behalf.
What We Do Not Do
- We do not send Customer Content to advertising, content-licensing, or AI-training third parties.
- The subprocessors above support hosting, network/CDN, payments, CRM and email, marketing-website analytics, and (conditionally) key management only.
- Google Analytics runs only on our marketing website, only after affirmative cookie consent, and is not loaded on the authenticated Service.
Changes
We will update this page when subprocessors change and provide advance notice to customers who have subscribed via privacy@encypher.com.