Subprocessors
This page lists third-party service providers that may process customer data in connection with Fallow hosted services. Fallow Cloud is hosted in the EU: the API and database run in Amsterdam, and stored files and database backups stay in the EU. Some other providers process data outside the EU.
Last updated:
| Vendor | Purpose | Data categories | Region | Website |
|---|---|---|---|---|
| Fly.io | Purpose: Runs the Fallow Cloud API and its database | Data: Account, team and billing records, API key hashes, audit log entries with IP addresses, coverage data | Region: EU (Amsterdam) | fly.io (opens in new tab) |
| Cloudflare R2 | Purpose: Stores coverage uploads, source maps, function inventories and database backups | Data: Coverage data, source maps (which can contain source code), database backups | Region: EU (EU-jurisdiction bucket) | cloudflare.com (opens in new tab) |
| Cloudflare Workers and Pages | Purpose: Workers serves the fallow.tools website; Pages serves the fallow.cloud dashboard | Data: Visitor IP addresses and request metadata | Region: Global | cloudflare.com (opens in new tab) |
| Stripe | Purpose: Billing and payments | Data: Billing contact, payment details and subscription data | Region: EU (Stripe Payments Europe, Ireland), with transfers to Stripe in the United States | stripe.com (opens in new tab) |
| GitHub | Purpose: Sign-in, and reading files from repositories that a customer links through the Fallow GitHub App | Data: GitHub user ID, login and public email, repository file contents | Region: Global | github.com (opens in new tab) |
| Resend | Purpose: Transactional email | Data: Email address and the content of account and alert emails | Region: Sends from the EU (Ireland). Stores account data, email metadata and logs in the United States | resend.com (opens in new tab) |
| PostHog | Purpose: Product analytics, error reports, and dashboard session recording for users who turn it on | Data: User ID, GitHub login, email and role, product usage events, masked dashboard session recordings, pseudonymous CLI telemetry, repository names from the GitHub Action | Region: EU (PostHog EU cloud) | posthog.com (opens in new tab) |
Cloudflare, Stripe and Resend include their data processing agreements in their customer terms. Stripe also acts as an independent controller for fraud prevention and its own legal duties. GitHub acts as an independent controller when you sign in with your GitHub account.
Where a vendor transfers personal data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on Standard Contractual Clauses. The data processing addendum describes how Fallow processes Fallow Cloud data for customers.
We update this page before a new vendor starts to process customer data.