Trust Pack · v1
Every third party. Named.
The exact services processing STEADYWRK data — role, region, SOC2 status, DPA link. Source-of-truth JSON at /trust/subprocessors.json.
| Service | Role | Region | SOC2 | DPA |
|---|---|---|---|---|
| Neon | primary-database | US-East (AWS us-east-2) | SOC 2 Type II | View DPA |
| Clerk | authentication | US (AWS multi-region) | SOC 2 Type II | View DPA |
| Upstash | cache-and-rate-limit | Global (Cloudflare edge) | SOC 2 Type II | View DPA |
| Sentry | error-monitoring | US (sentry.io) | SOC 2 Type II | View DPA |
| PostHog | product-analytics | US Cloud (posthog.com) | SOC 2 Type II | View DPA |
| Arcjet | bot-shield-and-waf | Global edge | in-progress | View DPA |
| Dots | contractor-payments | US (dots.dev) | SOC 2 Type II | View DPA |
| Resend | transactional-email | US (AWS us-east-1) | SOC 2 Type II | View DPA |
| Cloudflare | edge-network-and-dns | Global (280+ PoPs) | SOC 2 Type II + ISO 27001 | View DPA |
| Railway | application-hosting | US + EU edge (GCP underneath) | SOC 2 Type II | View DPA |
| GitHub | source-code-hosting | US (Azure underneath) | SOC 2 Type II + ISO 27001 | View DPA |