Subprocessors
The providers below may process customer data when Inly operates Core. Each one is named, along with what it does and where it is established.
Cloudflare
Cloud providerUnited States (global edge)DNS, CDN, R2 object storage for assets, and encrypted database backups.
ISO 27001SOC 2GDPRExpo
Push notificationsUnited StatesPush notifications to the Core mobile app. A notification's title and text pass through Expo to Apple's and Google's push services.
Laravel Cloud
Managed application platformUnited States (EU infrastructure region)Application hosting and managed PostgreSQL database (Neon) for Core.
ISO 27001SOC 2GDPRLaravel Nightwatch
MonitoringUnited States (EU infrastructure region)Application monitoring and error tracking.
GDPROpenAI
AIUnited StatesTranscription, audio, and content moderation in Core's AI features. Customer prompts and outputs are not used to train OpenAI's models. OpenAI may retain API content for up to 30 days for abuse monitoring before deletion.
SOC 2GDPROpenRouter
AIUnited StatesRoutes Core's AI requests to the model provider that serves them, Microsoft Azure for OpenAI's models. Data is never used for training. By default the provider may retain requests under its own terms, typically up to 30 days for abuse monitoring. Under strict privacy, requests are processed only in the EU/EEA, UK, or Switzerland and nothing is retained.
Resend
Email deliveryUnited States (EU infrastructure region)Transactional email from Core.
SOC 2GDPRTwilio
SMS deliveryUnited StatesSMS delivery from Core.
ISO 27001SOC 2GDPR
The data processing agreement defers to the current subprocessor list rather than freezing a copy of it. This page is kept up to date, and material changes are notified to customers in advance.
We use EU-based infrastructure regions. EU residency covers application data and backups; the regions above name where each provider is established, and the infrastructure region we run it in.