Sub-processors
Deadlock API Ltd. engages the third parties listed below to deliver the Deadlock Live Events API. Each entry names the sub-processor, the categories of personal data it processes on our behalf, the regions where that data is stored or transits, and the basis on which international transfers are made when the sub-processor is established outside the European Economic Area.
This list is the GDPR sub-processor disclosure referenced by every Data Processing Addendum we sign (see Data Processing Addendum).
| Sub-processor | Purpose | Categories of personal data | Storage region(s) | Transfer mechanism |
|---|---|---|---|---|
| Clerk (Clerk Inc., 660 King Street, Suite 345, San Francisco, CA 94107, USA) | Identity Plane: dashboard authentication, session issuance, account-recovery flows for operator and billing contacts. | Email address, hashed credential, name, multi-factor enrolment artefacts, session token, source IP, user-agent. | United States (Clerk operates in the US; EU customers' authentication metadata transits through US infrastructure). | EU Standard Contractual Clauses (Module 2) executed under Clerk's DPA; supplementary measures per Clerk's Trust Centre. |
| Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA) | Billing: customer record, metered usage reporting, invoicing, payment processing. | Customer billing contact, company name, VAT identifier, payment instrument metadata, Stripe customer / subscription / usage record identifiers. | Primary processing in the European Union (Stripe Payments Europe). Operational replication to the United States by Stripe, Inc. for fraud prevention and platform integrity. | EU Standard Contractual Clauses (Module 3) between Stripe Payments Europe and Stripe, Inc., flowed through to us via Stripe's DPA. |
| Cloud host — Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Control Plane infrastructure: PostgreSQL (Amazon RDS), Management API and Worker container hosting (Amazon ECS), backups, immutable audit log storage, secret management. | API key hashes, hashed customer identifiers, subscription audit logs, operational telemetry, encrypted secrets at rest. | Frankfurt (eu-central-1) is the primary region; backups are replicated to Ireland (eu-west-1). Both are inside the EU. No cross-region replication outside the EU is configured. | EU-only deployment; AWS EMEA SARL is the contracting entity. EU SCCs apply to any incidental support access from outside the EU under the AWS GDPR DPA. |
| Instatus (Instatus, Inc., 254 Chapman Rd, Ste 208 #14785, Newark, DE 19702, USA) | Status page hosting at status.deadlock-api.com: incident history, uptime statistics, and the summary.json feed consumed by the footer status pill. | None routinely. Visitor IP and user-agent reach Instatus when the public status page or summary.json feed is loaded. | Instatus is hosted in the United States. | EU Standard Contractual Clauses (Module 2) executed under Instatus' DPA. No customer or end-user personal data is published to the status page. |
Change notification
We notify customers at least thirty (30) calendar days before adding or replacing a sub-processor, and at least thirty (30) calendar days before removing one of the entries above. The notification is sent to the account email address and names the sub-processor, the processing purpose, the storage region, and the transfer mechanism.
A customer that objects in writing during the notification window may terminate the affected service for convenience without penalty as described in Data Processing Addendum § "Sub-processors".
To receive these notifications, subscribe by email at [email protected].
Authoritative copy
This file in the source repository is the authoritative copy. The public docs site mirrors it verbatim; if the two ever disagree, this file wins.
Last reviewed: 2026-05-03.