Subprocessors of Customer Data
These providers process Customer Data (the reports, packets, replays and other details captured through the widget) on our behalf under the Data Processing Addendum:
| Subprocessor | Location | Purpose | Data processed |
|---|---|---|---|
| DigitalOcean | United Kingdom (London) | Cloud hosting, managed database, and encrypted object storage for screenshots, replays and database backups | All service data, including account, report and packet data |
| Cloudflare | Global edge network | DNS, CDN, and edge delivery for the website, API, and widget (cdn.rebase.dev); runs the website and dashboard on Cloudflare Workers; terminates TLS at its edge | Request metadata (IP, user agent) and, in transit, request content |
| Amazon SES (AWS) | Ireland (EU) | Email delivery: sign-in codes, invitations, report activity emails, weekly summaries, usage and billing alerts, and setup emails | Recipient email address and message content |
| OpenAI | United States | AI triage of reports, related-report search and optional follow-up questions to the person who reported; see the AI Policy | A minimized, scrubbed slice of report text (description, console/network metadata, code frames) and any follow-up answer. Screenshots and replays are never sent; data is not used for training |
| Sentry | United States | Error monitoring of our own service | Error reports and stack traces, which may include request context |
| Stripe | United States | Payment processing and subscription billing | Billing contact and payment data (card data is held by Stripe, not Rebase) |
Providers for our own operations
These providers support Rebase’s own website and business (with Rebase as controller); they do not receive Customer Data captured through the widget:
| Provider | Location | Purpose | Data processed |
|---|---|---|---|
| Google (Google Analytics) | United States | Aggregate website usage analytics on rebase.dev, loaded only with your consent | Website usage events and online identifiers (e.g. cookies, IP address) |
| HubSpot | United States | CRM for sales and customer relationships | Business contact details (name, email, company), job role, company size, how you heard about us, plan and setup progress |
| Google Workspace | United States and other Google data centres | Hosting our email, including messages sent to support@rebase.dev and the mailboxes we use for our own outreach | Email you send us or we send you, with your name, email address and anything you include |
| Apollo.io | United States | Finding work contacts at businesses that may find Rebase useful, for our own outreach; see Business contacts | Business contact details (name, work email, job title, company, public profile URL) |
| Cal.com | United States | Booking calls with us; see Booking a call | Name, email address and anything you add to the booking |
Integrations you connect
The following are activated only when a customer chooses to connect them. When connected, the reports and packets sent to them are shared with that provider under the provider’s own terms:
| Provider | Purpose | Data processed |
|---|---|---|
| GitHub, Linear, Jira, Asana | Creating issues from reports and packets, adding comments, keeping status in sync, and requesting packets by mentioning Rebase on GitHub or Linear issues | The report or packet sent: title, description, captured details, the screenshot (attached where the tracker supports it) and a link to any replay, never the replay itself |
| Slack | Posting new reports to a channel, and requesting packets with /rebase or by mentioning Rebase | New-report notifications; support conversation references, linked account identifiers, status cards, and details opened by authorized users |
| AI agents via MCP (e.g. Claude, Cursor) | Customer-initiated agent workflows you authorize | Reports and captured details, including screenshots, that a teammate’s access token can read; see our AI Policy |
Changes & notice
We keep this list current, and give at least 14 days’ notice before a new subprocessor of Customer Data takes effect. To receive those notices, email support@rebase.dev and ask to be added to our subprocessor-change notification list. Customers may object to a new subprocessor as described in the Data Processing Addendum.