Legal
Subprocessors
Last updated: August 9, 2026
Ordinary Random Objects AB, trading as Tilligo, uses the following subprocessors to provide the service when processing personal data for customers.
Changes to this list
Under the DPA, Tilligo has general authorization to use subprocessors. We will provide at least 30 days’ prior notice of a new or replacement subprocessor by updating this page and, where practicable, by email or in the dashboard. Customers may object in writing on reasonable data-protection grounds within 14 days after notice.
| Provider | Legal entity | Purpose | Typical processing location and transfer safeguard |
|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited | Payment processing, subscriptions, invoices, and related customer billing identifiers. Stripe group providers may support these services. | Typically EEA-based for EU/EEA accounts, with processing also possible in locations where Stripe group providers operate. Transfers are governed by Stripe’s applicable contractual and transfer safeguards, including standard contractual clauses where required. |
| Resend | Plus Five Five, Inc. | Delivery of transactional, verification, billing, support, and lifecycle email. | Processing may occur in the United States and other locations used to provide the service. Where required, transfers rely on applicable contractual transfer safeguards, including standard contractual clauses. |
| Neon (a Databricks company) | Applicable Neon or Databricks entity under Tilligo's account agreement | Managed Postgres database hosting for application data and service operations. | Processing location depends on the selected database region and operational support. Data may be transferred outside the EEA; applicable contractual transfer safeguards, including standard contractual clauses, are used where required. |
| Vercel | Vercel Inc. | Hosting of the dashboard and widget, content delivery, serverless and edge runtime, and operational logs. | Processing may occur in regions used to deliver and operate the service, including outside the EEA. Where required, transfers rely on applicable contractual transfer safeguards, including standard contractual clauses. |
| Upstash | Upstash, Inc. | Redis-compatible storage for rate limiting, usage counters, and short-lived operational state. | Primary Tilligo resources are configured in Frankfurt. Operational support and provider subprocessors may involve processing outside the EEA; applicable transfer safeguards, including standard contractual clauses, apply where required. |
The locations above describe typical processing, not a promise of EU-only hosting or processing. Actual locations may vary with configuration, resilience, support, and the provider’s service delivery. See the DPA for Tilligo’s transfer terms.
Questions or objections about this list may be sent to legal@tilligo.app.