Effective 2026-04-27
Subprocessors
A "subprocessor" is any third-party service Tramplo uses to process customer data on our behalf in the course of delivering the product. We notify customer admins by email at least 30 days before adding or materially changing a subprocessor.
Active subprocessors
| Subprocessor | Role | Data accessed | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing for subscription billing | Customer name, billing email, billing address. Card data is tokenized — Tramplo never sees it. No employee monitoring data. | USA + global | Stripe DPA + EU SCCs (when applicable) |
| Contabo GmbH | Hosting for the application server, Postgres database, and screenshot file storage | All customer and employee data we collect (encrypted at rest where supported) | Germany / EU | Plesk + Contabo DPA on file |
| Let's Encrypt (ISRG) | TLS certificate issuance for app.tramplo.com | None — only the public hostname | USA | Public CA, no DPA needed |
Reserved (not currently active)
These vendors are configured in the codebase but are not currently processing customer data. They become subprocessors only if re-enabled.
| Subprocessor | Role | Data accessed | Location | Transfer mechanism |
|---|---|---|---|---|
| Resend Inc. | Outbound transactional email (verification, invites, password resets) | Recipient email + the contents of the transactional message | USA | Resend DPA |
What Tramplo itself operates
- The application server (Next.js + Node)
- Postgres database
- Screenshot file storage on local disk
- The Tramplo SMTP server (info@tramplo.com, port 465)
- Email-verification, password-reset, magic-login token issuance
Questions or objections
Email info@tramplo.com.