Subprocessors
Last updated October 31, 2026
Simplisik LLC uses these service providers to run Pulseback. Each processes personal data only to provide its part of the Services, under written terms that protect it (see our Data Processing Addendum and Privacy Policy).
Current subprocessors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and compute (Workers, Durable Objects), database (D1), queues, request logs, security and bot protection (Turnstile), sending and receiving email, custom status-page domains, and routing AI requests (AI Gateway) | All information processed by the service, including IP addresses, email content and the incident data sent to AI features | United States; served from Cloudflare’s global network |
| Stripe, Inc. | Payments, subscriptions, invoices and tax calculation (Stripe Checkout and Customer Portal) | Billing contact email, workspace name, plan, billing address where tax applies, and payment details you give Stripe directly | United States |
| 650 Industries, Inc. (Expo) | Delivering push notifications to the Pulseback mobile app, through Apple Push Notification service and Firebase Cloud Messaging | Device push tokens and notification content (incident title, severity and headline, workspace and environment, and who resolved it) | United States |
| Anthropic, PBC | AI incident summaries, likely-cause ranking and postmortem drafts, on plans that include AI features, through Cloudflare AI Gateway | Incident data only: title, severity, status, timeline, alert summaries, affected monitors and their results, and recent deploys (which can include names of responders and commit authors) | United States |
| Google LLC (Google Fonts) | Typefaces for this website, the dashboard and hosted status pages, requested by the visitor’s browser | IP address and browser details of the device that loads the fonts | United States |
What isn’t a subprocessor
- Services you connect, such as Slack, outgoing webhooks, your CI/CD system and your single sign-on identity provider. You choose them and they act for you, so information we send them at your direction is governed by your agreements with them.
- The systems your monitors check. Checks send them the requests, headers and credentials you configure.
- Text messages and phone calls aren’t offered at launch, so no telephony provider processes your data. If we add them, the provider will appear here first.
Changes and notice
We update this page before a new subprocessor starts processing personal data, and tell account owners by email at least 15 days in advance, as the DPA describes. To ask about a provider or object to a change, email privacy@pulseback.io.