Legal
Subprocessors
Last updated: August 26, 2026 · v2026-08-26
Engineer draft for transparency — not legal advice. A qualified lawyer should review before you treat this as final compliance guidance.
Engineer draft for transparency — not legal advice. This list describes current product architecture. Contracts (DPAs / SCCs) with each vendor should be confirmed by counsel and ops.
List version: 2026-08-26 · Last updated: August 26, 2026
Insta24 uses the following processors or independent controllers. “Location” is typical hosting / HQ, not a guarantee of every packet path.
| Provider | Role | Typical location | Notes |
|---|---|---|---|
| Cloudflare | CDN, DNS, Pages (website, panel, PWA, admin) | Global / US company | Necessary for delivery; may process IPs |
| VPS host (self-managed) | API, PostgreSQL, Redis, MinIO object storage, Docker | See ops — not a consumer cloud region picker | Source of truth for product data |
| Keycloak (self-hosted) | Authentication, sessions, Google IdP broker | Same VPS as API | Passwords are not stored in the Insta24 app DB |
| Stripe | Global card payments, customer & invoice objects | US / global | Independent controller for much payment data; we store customer ids and invoice metadata |
| ZarinPal | Iran-market payments | Iran | Only when workspace billing market is Iran. EEA/UK/CH workspaces are not sent to this gateway |
| Meta / Instagram | Graph API, webhooks, OAuth | US / global | Independent controller of the Instagram platform |
| Google (GTM / GA4) | Analytics when you consent (or US notice+opt-out before opt-out) | US / global | Not loaded for GDPR-regime visitors until opt-in |
| Google (Sign-In) | Optional login IdP via Keycloak | US / global | If you choose Google login |
| Sentry | Error monitoring, performance, masked session replay on the panel | EU ingest (ingest.de.sentry.io) | send_default_pii off on our servers; auth headers scrubbed |
| Transactional or marketing, if/when a mailer is connected | TBD | Marketing requires marketing_opt_in. No production marketing mailer is wired today |
Transfers from the EEA/UK/Switzerland to the US (Stripe, Google, Meta, Cloudflare) rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or a successor framework where required. Confirm signed terms with counsel.
We do not currently run a separate consumer email ESP. Automation “notify by email” is a stub unless a mailer is added later; that path must not send promotional mail without opt-in.
Questions: privacy@insta24.net