Subprocessors
Every third party that processes client data on Propel's behalf, what it does, where it runs and what data it sees. We notify subscribers at least 30 days before adding or replacing one.
| Vendor | Purpose | Region | Data it processes | Since |
|---|---|---|---|---|
Cloudflare R2 Security page ↗ | Private object storage for photos, badge PDFs, shipping documents and labels | Western North America | cardholder photos, rendered badge and document PDFs | Sep 25, 2026 |
Neon Security page ↗ | Primary PostgreSQL database | US-West (Oregon) | cardholder names, addresses, order data, staff and client accounts, audit and API logs | Sep 25, 2026 |
Pitney Bowes Security page ↗ | Carrier labels and postage | US | recipient name and ship-to address | Sep 25, 2026 |
PrintNode Security page ↗ | Print job transport to badge and document printers | US / EU | rendered badge and document PDFs at print time | Sep 25, 2026 |
Render Security page ↗ | Background worker (webhooks, pre-flight, retention purge) | US-West (Oregon) | order data during processing, webhook payloads | Sep 25, 2026 |
Resend Security page ↗ | Transactional email (portal invitations, password resets, verification) | US | account holder name and email address | Sep 25, 2026 |
Smarty Security page ↗ | Postal address verification (CASS) | US | ship-to addresses | Sep 25, 2026 |
USPS Security page ↗ | Mail delivery and Informed Visibility tracking | US | recipient name and ship-to address, mailpiece identifiers | Sep 25, 2026 |
Vercel Security page ↗ | Application hosting (Portal, Badge, Developers Portal, public API) | US (edge) / US-West functions | all application data in transit, cardholder data in request handling | Sep 25, 2026 |
Vercel Blob Security page ↗ | Public object storage for catalogue and equipment photos (not cardholder assets, which are in R2) | US | product and equipment images | Sep 25, 2026 |
Subprocessor change notices
Leave an address and we will notify you 30 days before a subprocessor is added, replaced or removed.