Sub-processors
Last updated: 27 July 2026
BookOS engages the third-party sub-processors listed below to deliver the Service. Each sub-processor is bound by a data-processing agreement no less protective than the BookOS Data Processing Agreement. We give registered billing contacts at least 30 days’ prior notice of any addition or replacement.
| Sub-processor | Role | Category | Location | Transfer mechanism | DPA |
|---|---|---|---|---|---|
Vercel Inc. Serving the BookOS web application; build & deployment pipeline; edge caching. | Hosting & CDN | Essential | EU (primary) / Global edge | EU SCCs (where applicable) | View |
Neon, Inc. Primary relational database; daily backups; point-in-time recovery. | Managed PostgreSQL | Essential | EU (eu-central-1) | EU-resident; no transfer outside EEA | View |
Stripe Payments Europe, Ltd. Card processing for end customers via Stripe Connect; BookOS subscription billing. | Payments & subscription billing | Essential | EU (Ireland) / US | EU SCCs + Data Privacy Framework | View |
Resend, Inc. Sending booking confirmations, reminders, password resets, and marketing campaigns. | Transactional & marketing email | Essential | EU / US | EU SCCs | View |
ONLINECITY.IO ApS (GatewayAPI) Sending appointment, reminder, and verification SMS when SMS notifications are enabled. | SMS delivery | Optional | EU (Denmark) / carrier networks | EU processing; carrier-required transfers where applicable | View |
Upstash, Inc. Idempotency keys, rate-limiting, lightweight caching. | Redis cache & rate-limiting | Essential | EU (eu-west-1) | EU-resident; no transfer outside EEA | View |
Vercel Blob (Vercel Inc.) Hosting tenant uploads (logo, gallery, product photos). | Object storage | Essential | EU / US | EU SCCs (where applicable) | View |
Google Ireland Ltd. Two-way calendar sync, only when a salon connects a Google account. | Google Calendar (optional) | Optional | EU / US | EU SCCs + Data Privacy Framework | View |
Meta Platforms Ireland Limited Reading recent media for a salon that connects an Instagram Business or Creator account. | Instagram content feed (optional) | Optional | EU / US | EU SCCs + applicable Meta transfer addenda | View |
Cloudflare, Inc. Assessing signup requests for automated abuse when Turnstile is enabled. | Turnstile bot protection (optional) | Optional | Global edge network | EU SCCs + Data Privacy Framework | View |
Trustpilot A/S Displaying the configured Trustpilot profile and review widget after visitor consent. | TrustBox review widget (optional) | Optional | EU (Denmark) / approved sub-processors | EU processing; SCCs for restricted transfers | View |
Tucows Inc. (OpenSRS) Registering, renewing, and configuring DNS for a domain when a salon purchases managed domain registration. | Domain registration and DNS | Optional | Canada / applicable global domain registries | EU adequacy decision for Canada; registry-required transfers and safeguards where applicable | View |
Sentry (Functional Software, Inc.) Capturing application errors and performance metrics for diagnostics. | Error tracking | Essential | EU (data residency) | EU-resident option enabled; EU SCCs where US transfer occurs | View |
Essential sub-processors are engaged for every customer and are required for the Service to function. Optional sub-processors are only engaged when a customer enables the relevant feature (for example, GatewayAPI is engaged only when SMS notifications are turned on; Google Ireland only when a salon connects a Google Calendar; OpenSRS only when a salon purchases managed domain registration).
Changes to this list
We update this page whenever a sub-processor is added, replaced, or removed. Customers on paid plans may subscribe to change notifications via the billing dashboard, or by emailing admin@bookos.dk.
Changelog
- 2026-07-27 — Removed Twilio Ireland Limited; GatewayAPI is the sole optional SMS delivery provider.
- 2026-07-27 — Added Tucows Inc. / OpenSRS (Optional, managed domain registration and DNS).
- 2026-06-03 — Added Twilio Ireland Limited (Optional, SMS delivery). Added Essential / Optional categorisation column.
- 2026-04-28 — Initial sub-processor register published.
Objecting to a new sub-processor
If you object to a newly announced sub-processor on reasonable data-protection grounds, write to admin@bookos.dk within 30 days of the announcement. If the objection cannot be resolved, you may terminate the affected Service component for the remainder of the billing period with a pro-rated refund of unused prepaid fees.