Subprocessors
Last updated: 25 July 2026
Mortar uses the infrastructure providers below to run the service. Each processes personal data only to provide its service to us, under a data-processing agreement with terms no less protective than our own DPA. We remain responsible for their performance.
We give at least 30 days' notice before adding or replacing a subprocessor. To be notified of changes, email privacy@mortarsec.com and ask to be added to the subprocessor-change list.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Fly.io | Application and worker hosting (compute) | All service data in transit through compute | European Union (Frankfurt) |
| Neon | Managed PostgreSQL database | Account data + estate access metadata | European Union |
| Clerk | Authentication / identity for Mortar accounts | Account-user name, email, session | United States (SCCs) |
| Stripe | Subscription billing and payments | Billing contact, payment method (held by Stripe), plan state | United States / global (SCCs) |
| Resend | Transactional and notification email | Recipient email and message content | United States (SCCs) |
| Cloudflare | DNS, CDN, and network security (WAF) | Request metadata (IP, headers) | Global edge (SCCs) |
| Sentry | Error and performance monitoring | Diagnostic data with secrets and PII scrubbed before transmission | European Union |
| Anthropic | Optional AI policy-authoring and "Ask" features - only when your organisation enables them and provides a key; limited prompt text is sent, never your full estate | Short prompt text you submit | United States (SCCs) |
Notes
- Anthropic is optional and off by default. AI features send only the limited text needed to classify a question or draft a policy - not your estate data - and only when an admin turns them on and configures a key. Answers about your estate are computed by Mortar over your data, not by the model.
- Transfers to subprocessors established outside the EEA/UK are covered by the EU Standard Contractual Clauses (and the UK IDTA where applicable), as described in the DPA Section 6.
- Databricks is not a Mortar subprocessor: it is your own system that you connect. Mortar reads from it under credentials you provide.