Moby
Sub-processors
Last updated 6 August 2026
Article 28 entitles an organisation using Moby to know which other companies can see the personal data it entrusts to us, and to be told before that list changes. This is that list. It is where the data actually rests, not where the vendor is incorporated.
We will give at least 30 days' notice before adding a sub-processor that can access customer personal data, so an organisation that objects has time to raise it with us.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Salesforce (Heroku) | Application hosting, managed Postgres, background job dynos | All platform data | United States |
| Amazon Web Services | Underlying infrastructure and backup storage for Heroku Postgres | All platform data, at rest | United States |
| Redis Ltd (Redis Cloud) | Session store, background job queue, rate-limit counters | Session identifiers, queued job payloads, IP-derived counters | United States |
| SolarWinds (Papertrail) | Application log aggregation | Request metadata, IP addresses, error diagnostics | United States |
| Functional Software (Sentry) | Error and performance monitoring | Request metadata and user identifiers. Request bodies, query strings and credential headers are stripped before transmission | United States |
| Stripe | Subscription billing, customer payments, contractor payouts | Name, email, billing address, payment card details (held by Stripe, never by Moby) | United States and European Union |
| Twilio | SMS, WhatsApp, voice and phone-number verification | Phone numbers, message content, call metadata | Region selected per organisation — Ireland for EU and UK organisations, United States otherwise |
| Twilio SendGrid | Transactional email delivery and inbound email parsing | Email addresses, message content, attachments | United States |
| Google (Maps Platform) | Address lookup and autocomplete | Partial addresses typed into an address field, IP address | United States |
| Google (Cloud Storage) | Storage of uploaded documents, job photos and reports | Uploaded files and their metadata | United States |
| Google (Firebase Cloud Messaging) | Push notifications to browsers and mobile apps | Device push tokens, notification titles and bodies | United States |
| Google (Analytics) | Only once a visitor allows it, measuring visits to this site and the pages they reach | With consent: pages viewed on this site, IP address, and the browser identifiers the tag sets | United States |
| Anthropic | Extracting structured fields from documents a user uploads — works orders, bills, appliance data plates | The contents of the document submitted for extraction. Not used to train models | United States |
| OpenAI | Embedding text from indexed jobs, notes, documents and assets so staff can search them by meaning | Text chunks derived from content the organisation or contractor business already stores. Not used to train models | United States |
| Meta Platforms | WhatsApp Cloud API messaging; and, only once a visitor allows it, the Meta Pixel on this site and the web app that measures whether an advert led to a sign-up | Phone numbers, message content. With consent: pages viewed on this site or the web app, IP address, and the browser identifiers the pixel sets | United States and Ireland |
| ipapi.co | Country lookup from IP address, to decide which regional sign-in options to offer | IP address | United States |
Transfers outside the UK and EEA
Every provider above that holds data in the United States does so under the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses. Our messaging provider is configured to deliver from its Irish region for UK and EU organisations.
Data processing agreement
Our processing terms form part of the terms of service. An organisation needing a countersigned data processing agreement, or a copy of a sub-processor's own certifications, should write to privacy@moby.living.