Skip to content
grewray
grewray

Sub-processors

The service providers that help us run grewray: what each one does, what data it handles and where, and how we tell you before the list changes.

Last updated: September 25, 2026

The providers we use

These companies help us run grewray. Each is bound by written terms to process data only for us, only for the purpose listed, and to protect it at least as well as we do.

  • Microsoft Azure

    What it does
    Runs the app, its database and its backups, and sends text messages (SMS).
    What it handles
    Account data and all business data; phone numbers and message text for SMS.
    Where
    The Azure region we deploy to, which may be outside your country

  • Vercel

    What it does
    Hosts this website.
    What it handles
    Standard request logs of visits to the website.
    Where
    A global network of servers

  • Amazon Web Services (Amazon SES)

    What it does
    Delivers the emails the service sends: sign-up, security, quotes, invoices, reminders.
    What it handles
    Recipient email addresses, message content and delivery status.
    Where
    The AWS region we configure

  • Cloudflare (Turnstile)

    What it does
    Checks that a person, not a script, is using the sign-up and password-reset forms.
    What it handles
    Technical signals from the browser, and its IP address, for that check.
    Where
    A global network of servers

  • Have I Been Pwned (Pwned Passwords)

    What it does
    Tells us whether a new password has appeared in a known data breach.
    What it handles
    Only the first five characters of a one-way hash of the password. No personal data.
    Where
    A global network of servers

  • Paddle

    What it does
    Merchant of record for most subscriptions: takes payment, issues invoices, handles tax.
    What it handles
    Billing contact, plan and payment details, which Paddle collects directly.
    Where
    Paddle's own processing locations

  • Razorpay

    What it does
    Processes subscription payments billed in Indian rupees.
    What it handles
    Billing contact, plan and payment details, which Razorpay collects directly.
    Where
    India

Services you choose to connect

Some services are connected by you, not by us: your accounting software (QuickBooks Online, Xero or Zoho Books) and the payment provider behind your invoices' Pay now links. Data flows to them only when you connect them, at your instruction and under their own terms. They are your providers, not our sub-processors.

When this list changes

We tell account owners by email at least 30 days before a new sub-processor starts handling customer data, and update this page at the same time. How you can object is set out in our data processing addendum.

Questions

For more detail about any provider, write to hello@grewray.com.