Legal
Subprocessor List
Last updated: July 2, 2026
Furlpay engages the following third-party subprocessors to deliver our services. This list is maintained pursuant to our Data Processing Agreement and is updated at least 30 days before any subprocessor change takes effect.
Change notifications
To receive email notifications when this list is updated, enable Privacy notifications in Settings → Privacy → Communication Preferences. You may object to a new subprocessor within 14 days of receiving notice, as described in our DPA.
Infrastructure & hosting
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Vercel, Inc. | Edge hosting, CDN, serverless compute | HTTP request metadata, IP addresses (anonymized at edge) | US |
| Supabase, Inc. | PostgreSQL database, authentication, real-time subscriptions | Account data, encrypted user records, session tokens | US |
Identity & compliance
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Persona Identities, Inc. | KYC identity verification, document authentication, liveness checks | Government ID images, selfie photos, name, DOB, address (Furlpay retains only verification status) | US |
Payments & banking
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, merchant payouts | Payment card details (tokenized), billing address, transaction metadata | US |
| Marqeta, Inc. | Card issuing (Furlpay Card), card lifecycle management, transaction authorization | Cardholder name, card details, transaction history, shipping address | US |
| Wise Payments Ltd | Cross-border banking, multi-currency accounts, fiat payouts | Account holder name, bank account details, transaction amounts | UK |
Crypto & digital assets
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Turnkey Industries, Inc. | MPC key custody, secure key generation, transaction co-signing | Encrypted key shares, public wallet addresses, signing requests | US |
| Circle Internet Financial, LLC | Stablecoin issuance (USDC/EURC), programmable wallets | Wallet addresses, stablecoin transaction data, compliance metadata | US |
| Bridge.xyz (Stripe) | Crypto on-ramp / off-ramp, fiat-to-stablecoin conversion | User identity (for compliance), bank account details, conversion amounts | US |
Brokerage & investments
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Alpaca Securities LLC | US equities brokerage, trade execution, account custody (FINRA/SIPC member) | Full name, SSN/TIN, DOB, address, employment info, trading activity | US |
Analytics & observability
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| PostHog, Inc. | Product analytics, feature flags, session replay (opt-in) | Anonymized usage events, device type, feature interactions (IP anonymization enabled) | EU |
Data transfer safeguards
For subprocessors located in the United States, data transfers from the EEA are protected by:
- EU-U.S. Data Privacy Framework (DPF) certification, where the subprocessor is a DPF participant (Stripe, Vercel, PostHog).
- Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914), supplemented by transfer impact assessments, for all other subprocessors.
Wise Payments Ltd is established in the United Kingdom and data transfers from the EEA to the UK are covered by the European Commission’s adequacy decision for the UK (Decision 2021/1772).
Change log
| Date | Change |
|---|---|
| 2026-07-02 | Initial publication of subprocessor list. |