Subprocessors
Version subprocessors-v3 · Effective 15 September 2026. Ropely, Inc., Delaware, United States.
1. How to read this list
This register lists organizations that may process Ropely account data or merchant-customer data when a production deployment is configured. Isolated staging may already use a subset. Production names stay unconfirmed until the operator records the live host.
We will update this page before a new production subprocessor starts. Object on reasonable data-protection grounds by writing to privacy@ropely.io and stop using the service before the change takes effect.
2. Register
| Organization | Location | Purpose | When |
|---|---|---|---|
| Fly.io | United States / EU regions as configured | Application host and data store | When a production Fly app is designated |
| Cloudflare | Global edge, United States company | DNS, TLS, CDN, and optional email routing | When ropely.io production traffic uses the Cloudflare zone |
| Resend | United States | Transactional email | Only if sending is configured |
| OpenAI | United States | Investigator answers | Only in Test after privacy acknowledgment. Off in Live while sandbox-only stays on |
| Stripe | United States / Ireland | Optional Ropely SaaS billing. Not your customers' card data on merchant charges | Only after Ropely billing is enabled |