Subprocessors
Effective 20 October 2026 · Tolla, operated by Dmitrii Russu, 8006 Zürich, Switzerland
This page lists the companies that process personal data for Tolla when it provides the service to its customers ("subprocessors"), as referred to in the Data Processing Agreement. It does not list the services customers connect themselves, such as their own Stripe account: those are the customer's own processors.
Current subprocessors
| Subprocessor | What it does for Tolla | Data it processes | Where the data is |
|---|---|---|---|
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting of the website, the app and the API; request routing and logs | All service data in transit; request metadata such as IP addresses in logs | Application servers in Frankfurt, Germany (region fra1); Vercel's global network and support staff, mainly in the USA |
| Neon, LLC, a Databricks, Inc. company, USA | Managed Postgres database | All stored service data and account data | Amazon Web Services, Frankfurt, Germany (eu-central-1) |
| Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA | Sending account emails: confirming a new account's address, password reset | The account holder's email address and the link in the email; no data about customers' users | Sent from Ireland (eu-west-1); Resend stores account data and sent emails in the USA |
Neon in turn uses Amazon Web Services as its infrastructure provider; the database itself runs in the Frankfurt region.
Transfers
All three companies are based in the United States, so their staff and support systems may access data from there. Transfers are covered by the European Commission's Standard Contractual Clauses, with the Swiss and UK amendments, in their data processing agreements (Vercel: the Vercel Data Processing Addendum; Neon: the Databricks Data Processing Addendum that applies to Neon; Resend: the Resend Data Processing Addendum, which also states that Resend complies with the EU-U.S. Data Privacy Framework and its UK Extension). In addition, Vercel Inc. and Databricks, Inc. (whose certification covers Neon, LLC) are active participants in the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, according to the official list at dataprivacyframework.gov (checked 12 October 2026).
Where the infrastructure is
As the EU Data Act requires: the infrastructure that runs Tolla is located in Germany (EU), in the Frankfurt region of Vercel and Amazon Web Services. Account emails are sent through Resend, which stores them in the USA. The providers are subject to US law. We protect data against unlawful access by foreign authorities with encryption in transit and at rest, pseudonymisation of identity data, and the contractual commitments of our providers to resist and report government requests where the law allows.
Changes to this list
Before adding or replacing a subprocessor, Tolla updates this page and emails the account owner of every workspace at least 30 days in advance. Customers can object as described in the Data Processing Agreement. Questions: dmitrii@russu.net.
History
| Date | Change |
|---|---|
| 19 October 2026 | Resend also sends the email that confirms a new account's address. |
| 17 October 2026 | Added Resend, for password reset emails. |
| 12 October 2026 | First version: Vercel and Neon. |