Subprocessors

Last updated: 2026-04-17 · Effective: 2026-04-17

    A "subprocessor" is a third party we use to help deliver the service that may process personal data on our behalf. We deliberately keep this list short, use only reputable enterprise-grade vendors, and have written data-processing terms in place with each.
  

1. Current subprocessors

Vendor	Purpose	Data accessed	Location	Safeguard
Railway Hosting	Runs the Node.js/Express web application, terminates TLS, stores persistent volume for user records	Account records (bcrypt-hashed passwords), server logs, session store	USA (Fastly edge PoPs globally)	Railway DPA + SCCs
Google Workspace (Gmail) Email	Sends transactional and solicited commercial email from `info@blokusa.com`	Recipient email addresses, message subject + body, delivery metadata	USA + Google global	Google Workspace DPA + EU-US DPF
Google Apps Script Email proxy	Runs our server-side email-sending Apps Script Web App (SHARED_SECRET authenticated)	Payload of each outgoing email (recipient, subject, body)	USA + Google global	Part of Google Workspace DPA
Google Drive Video hosting	Hosts marketing videos embedded in public and data-room pages	Only playback telemetry within Drive's scope; we do not receive viewer identity	USA + Google global	Part of Google Workspace DPA
Google Fonts Typography	Serves Inter + Space Grotesk webfonts	IP address (transient, Google-side). We send no user data.	Google global	Google Fonts privacy notice
Squarespace (domain registrar + DNS) DNS	Holds DNS zone for blokusa.com (SPF, DKIM, DMARC, MX)	No user data; DNS records only	USA	Squarespace Privacy Policy
GitHub Source control	Private Git repository for source code; not used to store user data	None (source code only; `users.json` and `.env` are gitignored)	USA	GitHub DPA

2. Services we do not use

Google Analytics, Mixpanel, Segment, or any third-party analytics
Meta / Facebook Pixel, TikTok Pixel, LinkedIn Insights, Twitter/X pixel
Intercom, Zendesk, Drift, HubSpot, or other third-party support widgets
Stripe / Square / PayPal at this time (no direct payment collection on site yet)
CDN vendors other than Railway's built-in Fastly edge

3. Future additions

We will update this list before onboarding any new subprocessor that processes personal data. If you are under a customer agreement that requires notice of subprocessor changes, email info@blokusa.com to subscribe to change notices — we will email you with at least 30 days' advance notice.

4. Standards each subprocessor meets

We select subprocessors who maintain, at minimum:

SOC 2 Type II or equivalent independent security audit
Written Data Processing Addendum with GDPR Art. 28 terms
Standard Contractual Clauses for cross-border transfers
Encryption in transit (TLS 1.2+) and encryption at rest
Documented incident-response and breach-notification procedures
Right to audit or independent audit reports on request

5. Data-processing terms

If you are a customer (distributor, enterprise estimator user) and need a signed Data Processing Agreement, we will provide our standard DPA on request. Email info@blokusa.com with "DPA Request" in the subject line.

6. Contact

Questions about subprocessors: info@blokusa.com · 504-913-3606.

Read alongside our Privacy Policy, GDPR Rights, and CCPA Rights.