Subprocessors
Last updated
Instatus uses the third-party subprocessors below to provide the Service. Each one only receives the data it needs for the purpose listed, and each has signed data processing terms with us that are at least as protective as our Data Processing Addendum. Where a subprocessor is outside the EEA, UK or Switzerland, transfers are protected by the EU Standard Contractual Clauses or another lawful mechanism.
Our primary data store is in the United States: Amazon Web Services in Ohio (us-east-2) and North Virginia (us-east-1).
Infrastructure
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Primary hosting: application servers, primary database, queues, file storage, backups and email sending (Amazon SES) | United States |
| Vercel Inc. | Hosting and edge delivery for status pages, the dashboard and our websites, including custom domains | United States, with a global edge network |
| Cloudflare, Inc. | Network security, DDoS protection and delivery for our API | United States, with a global edge network |
| Hetzner Online GmbH | Servers that run monitoring checks and background workers | European Union, United States, Asia |
| ClickHouse, Inc. | Database for monitoring results and team activity logs | United States |
| Redis Ltd. | Caching and job queues | United States |
| Temporal Technologies, Inc. | Workflow scheduling for on-call escalations and incident automations | United States |
| Backblaze, Inc. | Storage of monitor response bodies and app feedback attachments | United States |
| Cloudinary Ltd. | Storage and delivery of uploaded images and incident attachments | United States |
| SimpleBackups | Running scheduled database backups, which are stored in our own AWS account | United States |
Notifications
| Subprocessor | Purpose | Location |
|---|---|---|
| Mailgun Technologies, Inc. | Sign-in emails, backup email delivery, and receiving alert emails from monitoring tools | United States |
| Twilio Inc. | Phone call alerts to on-call team members | United States |
| 650 Industries, Inc. (Expo) | Push notifications to the Instatus mobile apps, delivered through Apple Push Notification service and Firebase Cloud Messaging | United States |
Subscriber SMS messages and emails sent through your own provider account (for example your own Twilio, Vonage or SendGrid account) are processed by that provider under your agreement with it. They are not our subprocessors.
AI
These providers power AI features that are part of the Service. Some run automatically: incident summaries are refreshed whenever an incident changes, status page content is translated into the languages your page offers, and subscriber imports and new status pages are checked for abuse. Others run when you use them, such as drafting updates or answering questions in the dashboard, Slack and Microsoft Teams. The data sent can include incident content and timelines, responder names, monitor context and subscriber email domains. Providers process it only to return a result to us and are contractually prohibited from training their models on it.
| Subprocessor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Translation, the dashboard assistant and AI status page designs | United States |
| Google LLC (Gemini API) | Incident summaries, chat replies in Slack and Teams, and checks that protect subscriber imports from abuse | United States |
Accounts, billing and support
| Subprocessor | Purpose | Location |
|---|---|---|
| WorkOS, Inc. | Multi-factor authentication, Google sign-in and earlier SSO connections | United States |
| Paddle.com Market Limited | Reseller and Merchant of Record: payments, tax and invoices | United Kingdom |
| Urlbox Ltd. | Creating PDF copies of invoices | United Kingdom |
| Help Scout PBC | Customer support conversations | United States |
| Intuition Machines, Inc. (hCaptcha) | Bot protection on sign-up, sign-in and status page subscribe forms | United States |
| PostHog, Inc. | Feature flags for rolling out new features | United States |
| SmartBear Software, Inc. (Bugsnag) | Error monitoring for our web apps | United States |
SAML single sign-on and SCIM directory sync are provided by OrbitID, a product operated by Instatus, Inc. and covered by the same commitments.
Integrations you turn on
When you connect a third-party service, such as Slack, Microsoft Teams, Discord, Google Chat, X, Zapier, PagerDuty, Jira, Datadog, Intercom, Zendesk, WhatsApp, your own email or SMS provider, or a webhook, we send it the data needed for that integration on your instruction. These services work under their own terms with you and are not Instatus subprocessors. Turning an integration off stops the data flow.
Get notified about changes
We give at least 30 days' notice before a new subprocessor starts processing customer data, as described in section 5 of our DPA. To get these notices by email, write to privacy@instatus.com with the subject "Subscribe to subprocessor updates". Every change is also recorded on our policy updates page.