⚠Placeholder content — not legal advice. Final wording pending counsel review. The list below is a good-faith snapshot of the third parties that process service data on our behalf today and will be replaced by a counsel-drafted document.
Subprocessors
Last updated: July 28, 2026
About this list
Dentivore relies on a small number of third-party providers (“subprocessors”) to operate the service. Each subprocessor receives only the categories of data described in our Privacy Policy and is bound by a data processing agreement linked below where one is published.
Protected health information (PHI) is not in scope for any subprocessor: the product is designed not to receive patient-identifying information. See § 1 and § 5 of the Privacy Policy for what is and is not collected.
Hosting & infrastructure
- Railway — Application hosting, container build, and process orchestration for the Dentivore web application. Region: United States. Data processing agreement.
- Cloudflare — Edge network for dentivore.com: DNS, TLS termination, CDN caching, and WAF. All request traffic, including IP addresses, transits Cloudflare. Cloudflare additionally provides: Access (the identity gate on non-public environments, which sees the signed-in email address), Turnstile (bot protection on sign-in: the visitor IP is sent to Cloudflare to verify the challenge token), and R2 object storage (hosting the digital downloads served to members). Region: Global edge network; account region United States. Data processing agreement.
Email delivery
- Resend — Email delivery: transactional email (sign-in one-time passcodes, receipts, and account/subscription notices) and opt-in marketing email (product updates). Region: United States. Data processing agreement.
- Google Workspace — Business email hosting for [email protected]: the inbox receives support correspondence, which may contain user-submitted data (e.g. privacy, billing, or refund requests). Region: United States (Google Workspace US-hosted organization). Data processing agreement.
Payments
- Stripe — Subscription billing and payment processing. Card data is handled by Stripe directly; Dentivore never stores card numbers. Region: United States. Data processing agreement.
Observability
- Sentry — Error and performance monitoring. PII scrubbing is applied client- and server-side before events are transmitted. Region: United States. Data processing agreement.
- PostHog — Product analytics. Event property allowlist is enforced in-browser so free-form fields cannot leave the client. Region: United States (default cloud region). Data processing agreement.
- Cloudflare Web Analytics — Page-load and performance measurement, injected by the Cloudflare edge into every proxied HTML response. Cookieless: it sets no cookie, writes nothing to browser storage, does not fingerprint visitors, and is not linked to a Dentivore account. Region: Global edge network; account region United States. Data processing agreement.
Changes to this list
We will update the “Last updated” date at the top of this page when subprocessors are added or removed. Material changes will be surfaced in-app.