These are the companies that process personal data on our behalf when you use Asorium, what each of them does, and where the data sits. It is the same list our Privacy Policy refers to, kept on its own page because it changes more often than the policy around it.
Who processes what
| Company | What they do for us | Where the data is |
|---|---|---|
| Fly.io | Runs the application | EU (Frankfurt); the company is in the USA |
| Neon | Hosts the database | EU (Frankfurt); contracted through Databricks, Inc. in the USA |
| Cloudflare | DNS, email routing, cookieless site analytics, and the bot check on the contact form | A global network for DNS, analytics and the bot check. The company is in the USA |
| OpenAI | Produces the translations | USA. This is the one that receives the text you are translating |
| Sentry | Collects error reports | EU storage region; the company is in the USA |
| PostHog | Collects product analytics and plugin crash reports | EU cloud (Germany); the company is in the USA |
| Resend | Sends transactional email | USA, including message metadata and delivery logs, whichever sending region is selected |
Two companies that are not on that list, and why
Paddle sells to you. It is the merchant of record: it takes the payment, issues the invoice and handles tax, deciding for itself how it processes what it collects. That makes it an independent controller rather than someone acting on our instructions, and its own privacy terms govern the payment data. We never see your card details.
Figma signs you in. Data flows the other way — Figma tells us who you are when you authorise the plugin, and we send it nothing about you. It is the source of that data, not a processor of ours.
Both are named here because leaving them off a page like this raises the question of what else is missing.
When data leaves Europe
Our servers and databases are in the EU. Three things reach the United States, and each is listed above: the translation itself, transactional email, and the sign-in check with Figma.
The rest is a matter most vendor lists gloss over: several of these companies run European data centres while being American companies. The data stays in Europe; the corporate group that administers it does not. We name the contracting country for each of them above rather than writing "EU" and leaving it there.
The safeguards for each transfer are set out in the Privacy Policy.
Keeping this page honest
This list is maintained alongside our internal record of processors and is updated in the same change — not on a schedule, and not after the fact. The version at the top of this page is when it last changed.
If a processor is added, removed, or moves region, this page changes with it. Where the change is material to how your data is handled, the Privacy Policy changes too, and that carries its own notice.