Subprocessors
Last updated: July 11, 2026
This list identifies providers that may process Deadweight account or connected-workspace data. A provider marked "when enabled" does not receive data until that feature is configured and used.
| Provider | Service | Data | Location / transfer note |
|---|---|---|---|
| netcup GmbH | VPS hosting and storage | Application database, encrypted OAuth tokens, logs, backups, and static site | Germany |
| Cloudflare, Inc. | DNS, TLS edge, network security, and traffic proxying where enabled | Domain requests, IP and network metadata | Global network; provider transfer safeguards apply |
| Zoho Corporation group (when transactional email is enabled) | Account verification, magic links, and service email | Recipient address, message content, delivery metadata | Account-selected and provider processing regions |
| Lava.top (when checkout is enabled) | Checkout, payment processing, subscriptions, and webhooks | Buyer and payment details, product and contract identifiers, status, amount, currency | Provider and payment-partner regions |
| Klaviyo, Inc. | Merchant-selected connected platform | OAuth grants, profiles, segments, metrics, lists, subscription and bulk-job data | Under the merchant's Klaviyo agreement and selected account configuration |
What is not used
The production dashboard does not use advertising networks, cross-site behavioral advertising, session replay, or a third-party customer-data warehouse. Public fonts and core assets are served from Deadweight's own origin after production packaging.
Updates
Material changes will be posted here with a new date. Customers with an active paid capability may request direct notice and may object on reasonable data-protection grounds by emailing hello@deadweight.email.