Rezidomestics · Moby
Sub-processors
Last updated 5 August 2026
Article 28 entitles an organisation using Moby to know which other companies can see the personal data it entrusts to us, and to be told before that list changes. This is that list. It is where the data actually rests, not where the vendor is incorporated.
We will give at least 30 days' notice before adding a sub-processor that can access customer personal data, so an organisation that objects has time to raise it with us.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Salesforce (Heroku) | Application hosting, managed Postgres, background job dynos | All platform data | United States |
| Amazon Web Services | Underlying infrastructure and backup storage for Heroku Postgres | All platform data, at rest | United States |
| Redis Ltd (Redis Cloud) | Session store, background job queue, rate-limit counters | Session identifiers, queued job payloads, IP-derived counters | United States |
| SolarWinds (Papertrail) | Application log aggregation | Request metadata, IP addresses, error diagnostics | United States |
| Functional Software (Sentry) | Error and performance monitoring | Request metadata and user identifiers. Request bodies, query strings and credential headers are stripped before transmission | United States |
| Stripe | Subscription billing, customer payments, contractor payouts | Name, email, billing address, payment card details (held by Stripe, never by Moby) | United States and European Union |
| Twilio | SMS, WhatsApp, voice and phone-number verification | Phone numbers, message content, call metadata | Region selected per organisation — Ireland for EU and UK organisations, United States otherwise |
| Twilio SendGrid | Transactional email delivery and inbound email parsing | Email addresses, message content, attachments | United States |
| Google (Maps Platform) | Address lookup and autocomplete | Partial addresses typed into an address field, IP address | United States |
| Google (Cloud Storage) | Storage of uploaded documents, job photos and reports | Uploaded files and their metadata | United States |
| Google (Firebase Cloud Messaging) | Push notifications to browsers and mobile apps | Device push tokens, notification titles and bodies | United States |
| Anthropic | Extracting structured fields from documents a user uploads — works orders, supplier invoices, appliance data plates | The contents of the document submitted for extraction. Not used to train models | United States |
| Meta Platforms | WhatsApp Cloud API messaging | Phone numbers, message content | United States and Ireland |
| ipapi.co | Country lookup from IP address, to decide which regional sign-in options to offer | IP address | United States |
Transfers outside the UK and EEA
Every provider above that holds data in the United States does so under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses. Our messaging provider is configured to deliver from its Irish region for UK and EU organisations.
Data processing agreement
Our processing terms form part of the terms of service. An organisation needing a countersigned data processing agreement, or a copy of a sub-processor's own certifications, should write to privacy@moby.living.