Sub-processors

The list

These are the third parties that process, or are contracted to process, data on behalf of FortressFlag LLC’s customers. It is transcribed from our internal record of processing activities and is the complete set — there is no separate “affiliates” or “infrastructure” list somewhere else.

Sub-processor	What it processes	Purpose	Status
Amazon Web Services	Control-plane and data-plane compute, the database and its backups, the cache, secrets and encryption keys — therefore all account data and all customer configuration — and the delivery of the websites and the dashboard (CloudFront). Processing takes place in the United States (Region us-east-2, Ohio).	Hosting the Service	In use.
Resend	Transactional email: the recipient’s address and the message — invitations (with the inviter’s and the organisation’s names and the accept link), password-reset links, and support notifications.	Transactional email delivery	In use.
Microsoft 365	FortressFlag’s own business email: correspondence sent to our privacy, legal, abuse and security addresses, and support-ticket notifications to our staff (the organisation’s name and the ticket subject).	Business email	In use.
GitHub	Source code and continuous integration. No customer data.	Development and change management	In use.
Stripe	The purchasing owner’s email address, the organisation’s name and URL slug, and monthly device counts. Never device identifiers, flag configuration, or end-user data. Cardholder data is entered on Stripe’s own hosted pages and never reaches our systems.	Billing and payments	Contracted; not processing — paid plans are not yet available.

Notice of changes

Before a new or replacement sub-processor begins processing customer data we give notice in the product — a notice every member of an organisation sees when they sign in — and the objection process in section 3.5 of the Data Processing Agreement applies.

Notice is given in the product on purpose. It is the one channel every member of an organisation reliably has: a notice shown at sign-in cannot bounce, go to spam, or reach only a stale contact address.

What is deliberately not on this list

• Your identity provider. If your organisation uses SAML single sign-on or SCIM provisioning, that identity provider is your processor, not ours. We store its public metadata — an entity identifier, a sign-in URL and a signing certificate — and never act on its behalf.
• Analytics, advertising, session recording, customer messaging, support desks, error tracking. None are in use, in the marketing site or in the dashboard — support is handled inside the product by FortressFlag itself, with no third-party help desk. Adding one would be a sub-processor decision and would appear here first.