Sub-processors
Last updated: 13 July 2026
In short: these are the third-party infrastructure providers we rely on to run the hosted webhook.co service, what each one does, and the data it may handle. We update this page whenever the list changes.
A "sub-processor" is a third party we use to help provide the Service that may process personal data on our behalf. This page supports our Privacy Policy and, for business customers, our Data Processing Agreement. All of the providers below are engaged under data-protection terms (including Standard Contractual Clauses where personal data is transferred internationally).
Current sub-processors
| Sub-processor | What it does | Data it may process | Location |
|---|---|---|---|
| Cloudflare, Inc. | Platform compute, storage, and network — Workers, R2 (payload storage), KV, Durable Objects, CDN/edge, Turnstile (login bot-protection), and CLI telemetry (Analytics Engine). | Captured webhook payloads and headers; account and session data in transit; minimal anonymous CLI telemetry. | United States (global edge network) |
| Neon, Inc. | Managed PostgreSQL database for metadata and account data. | Account and identity data, organisation data, event metadata, and session records (including IP address and user-agent). | United States |
| Amazon Web Services, Inc. | Key management (AWS KMS) for envelope-encrypted secrets. | Encryption keys only — never your webhook payloads or personal data. | United States |
| Stripe, Inc. | Payment processing and subscription billing. | Billing and customer details. Stripe handles payment-card data directly; we don't store full card numbers. | United States |
| Resend | Transactional email — magic-link sign-in and service notifications. | Recipient email address and the content of those messages. | United States |
| Google LLC | "Sign in with Google" (OAuth), and Google Identity Services, which powers the one-tap sign-in prompt on our login page. | Your Google account email and basic profile, shared when you sign in with Google. Our login page loads Google's script on every visit, so Google can see your IP address and that you opened it — before you choose anything. | United States |
| GitHub, Inc. | "Sign in with GitHub" (OAuth); distribution of the CLI and its installer (GitHub Releases); and, as a GitHub secret-scanning partner, notifications when a webhook.co API key is found in a public repository. | Your GitHub account email and basic profile if you sign in with GitHub; when GitHub reports a leaked key, the matching key and the repository it was found in. | United States |
| Mintlify, Inc. | Hosting for our documentation site (docs.webhook.co). | Standard web-server logs for documentation visitors (IP address, user-agent). No account data or webhook payloads. | United States |
Changes to this list
When we add or replace a sub-processor, we'll update this page and its "Last updated" date above.
If you object on reasonable data-protection grounds, your rights — including the notice we owe you before a new sub-processor starts handling your data — are set out in §6 of our Data Processing Agreement.