Transparency
Sub-processors
In short
These are every third party that may process personal data on our behalf. The list is deliberately short, because the data your workflows actually handle never reaches us — it moves between your own Cloudflare account and the services you connected.
We notify customers 30 days before adding a new sub-processor that processes personal data.
This page is published under Article 28(2) of the GDPR and forms part of our Data Processing Addendum. “Sub-processor” means a third party we engage that may process personal data in the course of providing Nodes2Cloud to you.
1. Always engaged
These are engaged for every account. You cannot use Nodes2Cloud without them, because they are the infrastructure it runs on.
| Sub-processor | What it does for us | Data it may receive | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting for the website, editor and API; all control-plane storage (D1, KV, Durable Objects); WAF, DDoS mitigation and rate limiting. | Account details, session records (including IP address and user agent), workflow graphs, deployment records, billing references, audit logs. | Global edge network; data at rest in Cloudflare's distributed infrastructure |
| Zoho Corporation (ZeptoMail) | Delivery of transactional email — email verification codes, password reset codes and service notices. | Email address, name, one-time verification codes. | India (api.zeptomail.in) |
| Anthropic PBC | Powers the AI workflow assistant. Our API sends each request directly to Anthropic's Claude API. | The prompt you type; the workflow graph you are editing, with credential fields removed; an example trigger payload you type into the assistant (with emails and phone numbers masked), or, automatically, only the shape of the trigger's saved sample payload or your last test run's input (field names and value types, no values); your answers to the assistant's clarifying questions; and, in Ultra mode only, the recent messages of your assistant conversation for that workflow and the assistant's last unapplied proposal. Account identifiers (user id, email) are not sent. | United States |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek API) | Fallback for the AI workflow assistant. If a request to Anthropic fails (an outage, an error or a timeout), our API completes that same request through DeepSeek's API. | The same data as for Anthropic, for the requests it completes: the prompt you type; the workflow graph you are editing, with credential fields removed; an example trigger payload you type into the assistant (with emails and phone numbers masked), or, automatically, only the shape of the trigger's saved sample payload or your last test run's input (field names and value types, no values); your answers to the assistant's clarifying questions; and, in Ultra mode only, the recent messages of your assistant conversation for that workflow and the assistant's last unapplied proposal. Account identifiers (user id, email) are not sent. | People's Republic of China |
| Dodo Payments | Payment processing for customers billed outside India, acting as Merchant of Record: Dodo is the seller on the transaction and handles sales-tax calculation and remittance. Card and wallet details are collected on Dodo's own hosted checkout and never reach our servers. | Name, email address, billing country and currency, tax identifiers where supplied, payment method details (held by Dodo, not by us), transaction records. | Global (Merchant of Record) |
| Razorpay Software Private Limited | Payment processing for customers billed in India. Card and UPI details are collected on Razorpay's own hosted checkout and never reach our servers. | Name, email address, billing country, payment method details (held by Razorpay, not by us), transaction records. | India |
2. Only if enabled
Wired into the platform but dormant unless a specific configuration is enabled. Where disabled, no data reaches them at all.
| Sub-processor | What it does for us | Data it may receive | Location |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Application error reporting, used to diagnose faults. Disabled unless a reporting endpoint is configured; when disabled no data leaves our infrastructure at all. | Error type and message, and limited technical context attached to the error. Credentials and secret values are never included. | United States |
3. Only if you connect it
These receive data only if you choose to sign in with them or connect them as an integration. Disconnect the integration and the flow stops.
| Sub-processor | What it does for us | Data it may receive | Location |
|---|---|---|---|
| Google LLC | Sign-in with Google, and the Gmail, Sheets, Drive, Calendar, Docs, YouTube, Analytics, BigQuery and Firestore integrations. | For sign-in: your Google account email, name and profile picture. For integrations: an encrypted OAuth token, plus whatever data the integration you chose reads or writes. | United States and global |
| GitHub, Inc. (Microsoft) | Sign-in with GitHub, and the “push workflow to a repository” feature. | GitHub username and account id, email address, an encrypted OAuth token, and the workflow source you choose to push. | United States |
| Microsoft Corporation | Outlook, OneDrive and Teams integrations, when connected. | An encrypted OAuth token and the data the integration reads or writes. | United States and global |
| Salesforce, Inc. | Salesforce integration, when connected. | An encrypted OAuth token and the data the integration reads or writes. | United States and global |
| Dropbox, Inc. | Dropbox integration, when connected. | An encrypted OAuth token and the files the integration writes. | United States |
| X Corp. | X (Twitter) integration, when connected. | An encrypted OAuth token and posted content. | United States |
4. Only with your consent
Used on the marketing website nodes2cloud.com only, and only after you click “Accept” in the cookie banner. Until then the analytics script is not loaded at all. You can change your choice at any time with Cookie settings in the footer; see the Cookie Policy.
| Sub-processor | What it does for us | Data it may receive | Location |
|---|---|---|---|
| Google LLC (Google Analytics) | Aggregate traffic measurement on the marketing website nodes2cloud.com, only for visitors who accept analytics cookies. Not loaded in the editor. Advertising features are never enabled. | Pages visited, referrer, browser and device information, approximate location derived from IP address, and the identifiers stored in the _ga and _ga_<id> cookies. | United States and global |
5. What we do not use
Stated explicitly because it is easy to verify by inspecting the pages we serve. Apart from the opt-in website analytics in section 4, we run no analytics, advertising or product-telemetry vendor — none in the editor and none in the API:
- PostHog
- Plausible
- Mixpanel
- Amplitude
- Segment
- LogRocket
- Hotjar
- Microsoft Clarity
- Facebook / Meta Pixel
- Any advertising or retargeting network
6. Integrations you choose are not our sub-processors
Nodes2Cloud ships connectors for well over a hundred services — AWS, Slack, Notion, Airtable, Twilio, HubSpot, Shopify, OpenAI and many more. It is worth being precise about these:
- They are not our sub-processors. When your deployed workflow calls one, the call is made by your Cloudflare Worker using your credentials. We are not in the request path and receive nothing from it.
- You are contracting with them directly. If you need a data processing agreement with such a provider, it is between you and them.
- The providers listed in section 3 appear there only because they are involved in our own sign-in or connection flow, where we do handle the token.
7. How we vet sub-processors
Before engaging a sub-processor that will handle personal data, we:
- confirm they offer contractual terms that meet GDPR Article 28 and are compatible with the DPDP Act;
- check their security posture and published certifications, and their history of handling incidents;
- confirm an appropriate transfer mechanism is available for data leaving the EEA, the UK or India; and
- give them the minimum data needed for their function. Our email provider gets an address and a code, not your workflows.
We remain responsible to you for our sub-processors’ performance of their data-protection obligations.
8. When this list changes
- We give at least 30 days’ notice by email to account holders before a new sub-processor begins processing personal data.
- If you have a reasonable, data-protection-based objection, tell us within that period at privacy@nodes2cloud.com. We will work with you to find an alternative; if none exists, you may terminate the affected service and receive a refund of prepaid, unused fees.
- Emergency replacements — where a sub-processor fails or must be replaced for security reasons — may be made immediately, with notice as soon as practicable afterwards.
- The date at the top of this page reflects the most recent change.
9. International transfers
Several sub-processors are outside India, the EEA and the UK. Transfers rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, with the technical measures described on our Security page. Under the DPDP Act, transfers outside India are permitted except to countries restricted by government notification.
More detail is in section 9 of the Privacy Policy.
Questions, or want to be notified of changes to this list directly? Email privacy@nodes2cloud.com.