This list identifies providers used by Sendiro and distinguishes active services from testing or disabled features. Their role depends on the information and purpose: an account or payment provider is not automatically a subprocessor of customer lists. Contractual authorization to process information on a customer’s behalf is governed by the data processing agreement.
Infrastructure and sending services
| Provider or service | Function | Information that may be involved | Known location and status |
|---|---|---|---|
| Google / Firebase Authentication | Identification and sign-in of authorized users. | Account information, identifiers and credentials managed by the authentication provider; connection information for security. | Active. Google documents that Firebase Authentication processes information in United States data centers. |
| Google / Cloud Firestore | Application and workspace database; access checks. | Contacts, consent, restrictions, settings, messages and activity events, according to the feature used. | Databases configured in nam5, a United States multi-region location. |
| Google / Cloud Storage for Firebase | Storage of customer resources and files. | Images, files and metadata added to service features. | Active; service bucket in us-central1, United States. Media links can be opened by anyone who possesses them, as described in the privacy policy. |
| Google / Cloud Functions for Firebase and Google Cloud operational services | Execution of API, tasks, automations and event reception; scheduling, logs and secret management needed for operation. | Information needed for each operation, contacts, messages, identifiers, results and technical records. | Main functions in us-central1 and account-creation function in us-east1, United States. These regions do not determine the location of all logs, supporting services or support access. |
| Amazon Web Services / Amazon SES and Amazon SNS | Email transport and sending, delivery, bounce, complaint, open and click event notifications. | Senders, recipients and content for SES, and technical sending and event information for the services that process it. | Configured in Ohio, United States (us-east-2). SES currently operates under Sandbox restrictions; real sending requires workspace admission and the service’s other controls. |
| Vercel | Hosting, web delivery and execution of site and application routes. | Requests, connection information and account or workspace information needed by hosted routes. | Hosting active; observed execution region iad1, United States. The distribution network may operate from other locations. |
Locations reflect the service’s configuration and operational evidence as of this version’s date. Each resource has its own location: an execution region does not ensure all information, metadata, support, logs or traffic remain there. Infrastructure involves international processing and does not offer exclusive residency of all information in Costa Rica, Mexico or the United States.
Provider obligations depend on the service and applicable contract. See official information on Firebase privacy and security, Firebase locations, AWS privacy and Vercel regions. Published provider terms or certifications do not themselves establish a Sendiro certification, a particular contract or a safeguard for every transfer. Where processing requires additional authorization or contractual safeguards, these must be formalized before processing; this list does not replace them.
Other providers and functions
Google / Firebase Analytics — disabled. Optional measurement is not initialized and does not send sign-in, registration or page-visit events. It is not an active subprocessor of customer lists. Authentication works without this measurement. See privacy and cookies.
PayPal — Sandbox testing. The available integration is limited to subscription-operation tests. There is no active commercial charging through this integration. When involved in a test, the provider may process account and operation information under its own obligations; it does not receive contact lists as part of payment and is not identified as a subprocessor of those lists. Real charging requires configuration and payment terms separate from this test environment.
Customer-selected destinations. A webhook endpoint or integration configured by a customer does not become a Sendiro-contracted provider merely by receiving information. The customer must validate its authorization and any required contracts.
Changes and questions
When this list forms part of an effective DPA, material changes will be communicated to the designated contact under that agreement, before new processing and with a way to raise reasoned objections. Publishing a row does not replace required authorization or activate the described service.
To learn the scope applicable to your workspace or ask about a provider, email support@sendiro.app with “Subprocessors” in the subject. The operator is identified on the contact and legal identity page.