Current subprocessors
These providers handle personal data so that CommentKit can run. Each one only receives what it needs for the job described.
- Amazon Web Services (AWS): File storage (Amazon S3) for screenshots, attachments, profile pictures and encrypted database backups, and email (Amazon SES) for sign-in codes, notifications and replies sent by email. Data: Uploaded files, database backups, email addresses and the content of the emails we send and receive. Where: India: the Asia Pacific (Mumbai) region, ap-south-1.
- Server hosting provider: The virtual private server that runs the CommentKit application, its database, background jobs and the realtime service. Data: Account, project and feedback records held by the service.
- Cloudflare: DNS, and the network that delivers and protects commentkit.dev (CDN and proxy). Web Analytics for our own website. Data: Network requests, including IP addresses and traffic data, and page-load measurements from our website. Where: Cloudflare’s global network.
- Google (Google Workspace): Our support inbox at [email protected]. Google sign-in, when a person chooses it. Data: Support emails you send us. Name, email address and profile picture for Google sign-in.
- Resend: Our contact list for product and onboarding emails. It does not deliver sign-in or feedback emails. Data: Name, email address, company, job title, plan, signup source, project count and activity dates of account holders.
- Dodo Payments: Hosted checkout, payments, invoices and the billing portal. Data: Buyer name and email, billing details and transaction and subscription records. Payment details are entered with Dodo Payments, never with us.
- Sentry: Error monitoring, only when we switch it on. Error reports leave out IP addresses, cookies and user details by default. Data: Technical details of errors in the application.
Feedback, files and backups are kept in India (AWS ap-south-1). Providers can process information in other countries; see the privacy notice.
Integrations you connect
When a project admin connects an integration such as GitHub, or adds a webhook, CommentKit sends the information that integration needs to the service you chose. Those services work for you under their own terms; they are not our subprocessors. Copying feedback into an AI agent works the same way.
Changes to this list
We keep this list current and tell workspace owners before a new subprocessor starts handling customer personal data. To ask about a provider or to object, contact [email protected]. The data processing agreement explains how subprocessors fit into our commitments.