Privacy
Subprocessors
Every third party that can touch data held in Authfu, what each one does, and where it runs.
Last updated
01What a subprocessor is
A subprocessor is a company Authfu uses that could come into contact with data Authfu holds while doing its job. The list below is complete, not a sample.
02Current subprocessors
| Subprocessor | What it does | Data it can reach | Region |
|---|---|---|---|
| Railway | Application hosting, the PostgreSQL database, and object storage for uploaded avatars | All stored data | United States |
| Amazon Web Services | Key Management Service in us-east-2; custody of the master key that wraps two-factor secrets | No personal data; key material only | United States |
| Resend | Delivery of transactional email, including sign-in links and security notices | Email address and the contents of that message | United States |
| Gandi | Domain registration and DNS | No personal data | European Union |
AWS holds the key, not the data. Encrypted two-factor secrets live in the Railway database. The key that unwraps them never leaves AWS. Neither company can read a secret alone.
03What we deliberately do not use
Authfu does not use any of the following:
- an analytics provider;
- an advertising network;
- an error-tracking or session-replay service;
- a customer-data platform;
- a support-chat widget; or
- a payment processor, because billing is not live.
This is why the list above has four rows rather than thirty.
04Infrastructure that is not a subprocessor
Authfu source code is hosted on GitHub, and the npm registry distributes the Authfu command-line tool. Neither service holds anyone’s personal data for Authfu, so neither is a subprocessor.
05Changes to this list
Advance notice
06How to be notified
Email privacy@authfu.com and ask to join the subprocessor change list. We will use that address for notices about additions or other material changes to this page.
07Contact
Contact Conversift, Inc. at privacy@authfu.com.