Last updated: 2026-05-26
Subprocessors
To operate Sentinel we use the third-party vendors listed below. We maintain executed Data Processing Agreements (DPAs) with each. We minimize the data shared, and never share customer approval content with vendors not in this list.
| Vendor | Purpose | Region | Data processed |
|---|---|---|---|
| Railway | Application hosting (sentinel-api), Postgres, Redis | us-east (Northern Virginia) | All tenant data including api keys (hashed), approval records, audit log |
| Vercel | Hosting for dashboard (app.pauseapi.app) and marketing/docs (pauseapi.app), edge proxy for api.pauseapi.app | Global edge network | TLS termination only — request/response bodies passed through, never stored |
| Resend | Transactional email delivery (approval emails, welcome, recovery) | us-east-1 (AWS) | Approver email addresses, approval metadata in email body |
| Twilio | Transactional SMS delivery (approval texts) — when customer enables sms: approvers | us1 | Approver phone numbers, approval metadata in SMS body |
| Stripe | Subscription billing and payment processing for Pro plan and above | us-east (Stripe-managed) | Customer email, billing address, payment-method tokens (we never see card numbers) |
| Sentry (when enabled) | Error monitoring on the API service | us-east (AWS) | Stack traces, request URLs, request IDs. Never request bodies, never approval contents (send_default_pii=False) |
| GitHub | Source-code hosting, CI/CD (build, test, publish SDKs) | us-east (Microsoft Azure) | Source code (no customer data) |
Notification of changes
We will notify customers at least 14 days before adding a new subprocessor that will process customer data. Notifications go to the account owner's email and are mirrored on this page.
If you object to a new subprocessor, email support@regengine.co within 14 days of the notification. We'll work with you to find an alternative or, if necessary, allow you to terminate the affected service with a pro-rated refund.
Sub-tier providers
Several of the vendors above run on AWS or GCP. We treat AWS and GCP as sub-processors of Railway, Resend, Twilio, and Sentry; we do not have direct contracts with them.
For DPA execution requests, see /privacy or email support@regengine.co.