Skip to main content

QueryBolt
Trust centre

Subprocessors &
third-party services.

Providers that may receive service data when operating QueryBolt, with conditional services clearly identified.

How to read this list. “Conditional” means the provider receives data only when its feature is configured, consented to, or selected by the customer. Payment and identity providers may act as independent controllers for some activities; the role shown below is deliberately more precise than calling every third party a subprocessor.
Provider register

Current service providers

Core AWS application infrastructure is configured in London. Provider support, payment networks, identity services and optional tooling may involve international processing under the provider’s applicable terms.

Amazon Web Services (AWS)

Core hosting infrastructure

Processor Core infrastructure
Purpose
Application compute, managed databases, encrypted storage, backups and infrastructure monitoring.
Data
Account data, customer-submitted optimization inputs and results, usage records, and technical logs.
Location
Core workloads are configured for the AWS Europe (London) Region. AWS support and service subprocessors may operate in other locations.
Privacy information Contractual or transfer safeguards

Sinch Mailgun

Transactional email

Processor Conditional
Purpose
Account verification, security and service messages, job notifications, support acknowledgements and opted-in email.
Data
Recipient name and email address, message content, delivery status and suppression metadata.
Location
Processing region depends on the configured Mailgun account and endpoint.
Privacy information Contractual or transfer safeguards

Stripe

Payments and subscription management

Processor and independent controller, depending on the activity Conditional
Purpose
Payment collection, recurring billing, tax calculation, customer portal access and fraud prevention.
Data
Name, email address, customer and subscription identifiers, billing details, payment status and fraud signals. QueryBolt does not store full card details.
Location
Stripe processes data through its regional and global payments infrastructure according to the service and transaction.
Privacy information Contractual or transfer safeguards

Sentry

Error monitoring

Processor Conditional
Purpose
Application error reporting, reliability diagnostics and sampled performance tracing.
Data
Error details, request and device metadata, affected route, application version and limited account identifiers when available. Raw SQL is not intentionally sent.
Location
Only active when configured. The selected Sentry account region determines primary hosting location.
Privacy information Contractual or transfer safeguards

PostHog

Server-side product analytics

Processor Conditional
Purpose
Measure feature adoption, onboarding progress and product reliability events.
Data
Account-scoped event identifiers, event names, plan and coarse product context. Customer SQL is not intentionally included.
Location
Only active when configured. Processing location depends on the configured PostHog host and account region.
Privacy information Contractual or transfer safeguards

Google

Web font delivery, optional Google sign-in and reCAPTCHA

Independent service provider and processor, depending on the activity Always active for web fonts; sign-in and reCAPTCHA conditional
Purpose
Deliver the fonts used by shared-layout pages, authenticate users who choose Google sign-in, and protect eligible public forms from automated abuse.
Data
For fonts: IP address, requested font or stylesheet, referrer and browser metadata. For sign-in: provider identifier, verified email and profile details. For reCAPTCHA: browser, device and interaction signals collected by Google.
Location
Font delivery is active on pages using the shared layout. Sign-in and reCAPTCHA processing occur only when the relevant feature is configured or selected. Google operates globally.
Privacy information Contractual or transfer safeguards

GitHub

Optional GitHub sign-in

Third-party identity provider Conditional
Purpose
Authenticate users who choose GitHub sign-in.
Data
GitHub account identifier, username, verified email and public profile details required for sign-in.
Location
Only active when configured and selected. GitHub operates globally.
Privacy information Contractual or transfer safeguards

Cloudflare

DNS, public asset delivery and optional edge proxying

Processor and network service provider, depending on the activity cdnjs assets requested by shared-layout pages; edge proxy conditional
Purpose
Resolve QueryBolt domains, deliver browser assets from cdnjs, and protect or accelerate public traffic when proxying is enabled.
Data
DNS request information and, for cdnjs or proxied requests, IP address, browser and device metadata, requested URL and security signals.
Location
Cloudflare operates a global network. This service is conditional on the requested asset and DNS or proxy configuration.
Privacy information Contractual or transfer safeguards
Changes

Provider updates

Material additions or replacements will be published on this page. Any advance-notice or objection rights are governed by the customer’s signed agreement and DPA rather than this informational page.

Need the current register for procurement?

Ask for a dated copy, account-specific processing-location confirmation, or a signed DPA.

Contact support@querybolt.io

Last updated 1 September 2026. Return to the security overview.