Legal
Subprocessors
Last updated: September 24, 2026
Version: 2026-09-24
Orquestr uses the processors on this list to provide the Cloud API and Orquestr Console. A provider is a subprocessor when it processes customer personal data on Orquestr's behalf.
Service providers
Hosting, data, files, rate limits, and installer builds.
Railway Corporation
- Purpose
- Hosting for the Cloud API and the device gateway: compute and runtime.
- Data
- Customer content, application logs, runtime secrets, and operational metadata.
- Typical location
- United States
Supabase, Inc.
- Purpose
- Authentication, PostgreSQL database, and file storage.
- Data
- Accounts and sessions, devices, licenses, configuration, branding files, and installers.
- Typical location
- United States, in the project region
Vercel, Inc.
- Purpose
- Hosting for Orquestr Console.
- Data
- Browser session, requests, and technical metadata.
- Typical location
- United States and a global delivery network
Cloudflare, Inc.
- Purpose
- Object storage, edge functions, delivery, and security.
- Data
- Media, files, request data, identifiers, and technical metadata.
- Typical location
- United States and global network locations
Upstash, Inc.
- Purpose
- Rate limits shared across replicas.
- Data
- Usage counters and rate-limit identifiers. Query results are not included.
- Typical location
- United States
GitHub, Inc.
- Purpose
- Building installers with the customer's branding.
- Data
- Branding manifest, installer artifacts, and build metadata.
- Typical location
- United States
Billing
Stripe may act as an independent controller for some processing, under its own terms and privacy notice.
Stripe, Inc. and applicable affiliates
- Purpose
- Payments, subscriptions, invoicing, usage, and fraud prevention.
- Data
- Account, contact, billing, transactions, usage, and limited device information.
- Typical location
- United States and the provider's locations
Site analytics
It measures visits to this site. It does not process the customer's point-of-sale or ERP content.
Google LLC
- Purpose
- Analytics of visits to this website.
- Data
- Cookie and device identifiers, pages viewed, and browser data.
- Typical location
- United States
Point-of-sale and other customer platforms
Point-of-sale systems, ERPs, and other platforms the customer connects are not Orquestr subprocessors. They are third-party services the customer chooses and authorizes. That third party sets their availability, terms, and data use.
Notice and objections
Orquestr will give at least 15 days' notice before a new subprocessor materially processes customer personal data, unless urgent use is necessary to protect security or availability. The customer may object on reasonable data-protection grounds, as the data processing agreement describes.