Sub-processors
Last updated: 10 July 2026
In short: these are the third-party infrastructure providers we rely on to run the hosted webhook.co service, what each one does, and the data it may handle. We update this page whenever the list changes.
A "sub-processor" is a third party we use to help provide the Service that may process personal data on our behalf. This page supports our Privacy Policy and, for business customers, our Data Processing Agreement. All of the providers below are engaged under data-protection terms (including Standard Contractual Clauses where personal data is transferred internationally).
Current sub-processors
| Sub-processor | What it does | Data it may process | Location |
|---|---|---|---|
| Cloudflare, Inc. | Platform compute, storage, and network — Workers, R2 (payload storage), KV, Durable Objects, CDN/edge, Turnstile (login bot-protection), and CLI telemetry (Analytics Engine). | Captured webhook payloads and headers; account and session data in transit; minimal anonymous CLI telemetry. | United States (global edge network) |
| Neon, Inc. | Managed PostgreSQL database for metadata and account data. | Account and identity data, organisation data, event metadata, and session records (including IP address and user-agent). | United States |
| Amazon Web Services, Inc. | Key management (AWS KMS) for envelope-encrypted secrets. | Encryption keys only — never your webhook payloads or personal data. | United States |
| Stripe, Inc. | Payment processing and subscription billing. | Billing and customer details. Stripe handles payment-card data directly; we don't store full card numbers. | United States |
| Resend | Transactional email — magic-link sign-in and service notifications. | Recipient email address and the content of those messages. | United States |
Changes to this list
When we add or replace a sub-processor, we'll update this page and its "Last updated" date above. If you'd like to be notified of changes, email sourabh@webhook.co. Business customers under a Data Processing Agreement receive advance notice of new sub-processors as set out in that agreement.