Sub-processors
Last updated: 23 July 2026
CMP IT ApS uses the following sub-processors to deliver Camwarden. Where a vendor is headquartered outside the EU, transfers are safeguarded under the EU-U.S. Data Privacy Framework (DPF) and/or the EU Standard Contractual Clauses (SCCs), as indicated. Customer photos are stored at rest in the EU (Frankfurt, Germany).
We will provide at least 30 days' notice before adding or replacing a sub-processor, by updating this page and emailing account owners. See our Data Processing Agreement for objection rights.
Sub-processors of Customer Content
| Vendor | Purpose | Data location | Entity HQ | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, private media storage | EU (AWS eu-central-1, Frankfurt) | USA | SCCs; data at rest in EU |
| Amazon Web Services EMEA SARL | Underlying cloud infrastructure (via Supabase) | EU (Frankfurt) | Luxembourg / USA parent | SCCs / DPF; data at rest in EU |
| Vercel Inc. | Application hosting and rendering | Global edge; EU function region (fra1) | USA | DPF + SCCs |
| Cloudflare, Inc. | CDN for authenticated media delivery, DNS, bot protection | Global edge network (transient processing) | USA | DPF + SCCs |
| Twilio Inc. (SendGrid) | Inbound email ingestion (camera photo emails) | USA | USA | DPF + SCCs |
| Sentry (Functional Software, Inc.) | Error monitoring | EU data region | USA | SCCs; EU data residency |
AI image analysis (wildlife and object detection) is performed on infrastructure operated by CMP IT ApS in Denmark. No external AI service receives your photos.
Processors of account and operational data only
These vendors do not process your camera media.
| Vendor | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| Resend, Inc. | Transactional email (sign-in codes, notifications) | USA | DPF + SCCs |
| Slack Technologies, LLC (Salesforce, Inc.) | Internal operational alerting — new signups, billing events, and user-submitted feedback text are relayed to our internal Slack workspace | USA | DPF + SCCs |
Independent controllers (not sub-processors)
| Vendor | Purpose | Notes |
|---|---|---|
| Polar Software, Inc. | Payment processing as Merchant of Record | Polar is the seller of record for paid subscriptions and processes billing data as an independent controller under its own privacy policy |
Third-party content services (map imagery and geocoding)
When you open a map view in Camwarden, your browser loads base-map imagery and, if you use the location search, geocoding results directly from the services below. These providers are not sub-processors — they process no Customer Content on our behalf — but each request necessarily transmits your IP address, browser user-agent, and the requested map area (tile coordinates or search text, which can reveal the geographic region you are viewing). No cookies are set by these requests and Camwarden sends them no account information.
| Provider | Service | Endpoint | Provider location |
|---|---|---|---|
| OpenStreetMap Foundation | Street base-map tiles | tile.openstreetmap.org | United Kingdom (servers in UK/NL) |
| OpenStreetMap Foundation | Location search (Nominatim public API) | nominatim.openstreetmap.org | United Kingdom |
| Esri (Environmental Systems Research Institute, Inc.) | Satellite imagery tiles | server.arcgisonline.com | USA |
| CARTO (CartoDB, Inc.) | Map label tiles | basemaps.cartocdn.com | USA / Spain (global CDN) |
Change log
| Date | Change |
|---|---|
| 23 July 2026 | Added Slack Technologies (Salesforce) as a processor of account and operational data (internal operational alerting; no camera media). Removed Cloudflare (cdnjs) from third-party content services — map marker images are now served from camwarden.com directly |
| 19 July 2026 | Added third-party content services section (map tiles and geocoding); no change to sub-processors |
| 8 July 2026 | Initial publication |
Questions: [email protected]