# Sub-processors

The vendors that hold or carry data for the API, what each does, and where.

## The list

Every vendor that holds or carries data on our behalf is on this list, with what it does for us and where. All of it is in the United States, US East. A vendor marked "when it ships" is not in use yet and is named now so nobody is surprised later.

| Vendor | What for | Region | Their page |
| --- | --- | --- | --- |
| Vercel | Runs the API and these docs; the first hop of the request logs | US East | https://vercel.com/legal/privacy-policy |
| Neon | The account database: accounts, keys (as hashes), switches, usage, audit trails | US East | https://neon.com/privacy-policy |
| Upstash | Rate limits, quotas, the auth cache, the usage counters before they fold | US East | https://upstash.com/trust |
| Axiom | The request logs, 30 days, and the monitors that page us | US East | https://axiom.co/privacy |
| Fly.io (when it ships) | The analytics ingest service | US East | https://fly.io/legal/privacy-policy |
| ClickHouse Cloud (when it ships) | Analytics events and their daily aggregates | US East | https://clickhouse.com/legal/privacy-policy |

## Changes

A vendor added to this list, or one replaced, is announced 30 days ahead on the [changelog](https://api.dietbloxycola.com/docs/changelog) and by mail to the address on the account. A vendor removed needs no notice.