Sub-processors
Last updated: July 3, 2026
These are the third parties that process data on our behalf to run the hosted service, what each one does, and what reaches it. None of them receive your source code or the values your users type; the SDKs never transmit those to anyone, including us. We notify account holders by email at least 30 days before adding or replacing a sub-processor, per the DPA.
| Sub-processor | Role | What reaches it | Location |
|---|---|---|---|
| Fly.io | Application hosting and TLS termination | All service traffic in transit: account data, crash telemetry, dashboard sessions | United States |
| Neon | Managed Postgres; each workspace gets its own isolated database | Account data; crash signatures, error messages, interaction paths, input fingerprints | United States |
| Cloudflare R2 | Evidence storage, credential-scoped per workspace | Reproduction artifacts: recordings and screenshots of synthetic replays your CI uploads | United States |
| Resend | Transactional email: verification, password reset, service notices | Your email address and the message content | United States |
| Stripe | Billing and payment processing | Your email, plan, and payment details you enter on Stripe-hosted checkout; we store only your plan and Stripe customer id | United States |
| Optional "Sign in with Google" | Your verified email address, only if you choose Google sign-in | United States | |
| WorkOS | Optional enterprise SSO and directory sync | Workspace members' names, emails, and directory membership, only if your workspace enables SSO/SCIM | United States |
Customer-directed services
If you connect an issue tracker or CI, we send data where you point us. These are your vendors acting on your instructions, not our sub-processors, and they activate only when you configure them:
- GitHub: reproduction dispatches to your CI carry only the app id, bucket id, and run id; issue sync sends crash signatures, messages, and repro paths to your repository.
- Jira (Atlassian), Linear, Shortcut: issue sync sends the same content class to the tracker you configure.
Questions or objections
Email agho@reproit.com. The objection process is described in the DPA.