Last updated: September 25, 2026
The providers we use
These companies help us run grewray. Each is bound by written terms to process data only for us, only for the purpose listed, and to protect it at least as well as we do.
Microsoft Azure
- What it does
- Runs the app, its database and its backups, and sends text messages (SMS).
- What it handles
- Account data and all business data; phone numbers and message text for SMS.
- Where
- The Azure region we deploy to, which may be outside your country
Vercel
- What it does
- Hosts this website.
- What it handles
- Standard request logs of visits to the website.
- Where
- A global network of servers
Amazon Web Services (Amazon SES)
- What it does
- Delivers the emails the service sends: sign-up, security, quotes, invoices, reminders.
- What it handles
- Recipient email addresses, message content and delivery status.
- Where
- The AWS region we configure
Cloudflare (Turnstile)
- What it does
- Checks that a person, not a script, is using the sign-up and password-reset forms.
- What it handles
- Technical signals from the browser, and its IP address, for that check.
- Where
- A global network of servers
Have I Been Pwned (Pwned Passwords)
- What it does
- Tells us whether a new password has appeared in a known data breach.
- What it handles
- Only the first five characters of a one-way hash of the password. No personal data.
- Where
- A global network of servers
Paddle
- What it does
- Merchant of record for most subscriptions: takes payment, issues invoices, handles tax.
- What it handles
- Billing contact, plan and payment details, which Paddle collects directly.
- Where
- Paddle's own processing locations
Razorpay
- What it does
- Processes subscription payments billed in Indian rupees.
- What it handles
- Billing contact, plan and payment details, which Razorpay collects directly.
- Where
- India
Services you choose to connect
Some services are connected by you, not by us: your accounting software (QuickBooks Online, Xero or Zoho Books) and the payment provider behind your invoices' Pay now links. Data flows to them only when you connect them, at your instruction and under their own terms. They are your providers, not our sub-processors.
When this list changes
We tell account owners by email at least 30 days before a new sub-processor starts handling customer data, and update this page at the same time. How you can object is set out in our data processing addendum.
Questions
For more detail about any provider, write to hello@grewray.com.