Subprocessor List
Consumer Dividends
Last updated: June 14, 2026
This list identifies the third-party service providers ("subprocessors") that may process customer personal data on behalf of Consumer Dividends. We publish it so that customers, their counsel, and their compliance teams can evaluate our supply chain. Updates are reflected in the "Last updated" date and, for material changes, emailed to active customers and Agency tier contacts at least 30 days before they take effect.
Active subprocessors
| Provider | Purpose | Data processed | Region | Compliance |
|---|---|---|---|---|
| Railway | Application hosting (Numidian) | All inputs and outputs during processing; access codes; usage logs | United States | SOC 2 alignment; encryption in transit and at rest |
| PostgreSQL on Railway | Database backing for Numidian | Case inputs, generated outputs, access codes, case history | United States | Same as Railway above |
| Cloudflare | DNS, CDN, edge security for consumerdividends.com and product subdomains | IP address, request paths, security logs | Global edge; primary US | SOC 2 Type II; ISO 27001; GDPR-aligned; DPA available |
| Stripe | Payment processing, subscription management, billing | Cardholder data (Stripe-tokenized, not stored by us), customer email, transaction history | United States and other regions per Stripe | PCI DSS Level 1; SOC 1, SOC 2; GDPR-aligned |
| Google Workspace | Operational email (support@, andreys@, admin@consumerdividends.com) | Email content sent to or from us | United States | SOC 1/2/3; ISO 27001/27017/27018; GDPR-aligned |
| GitHub | Source code hosting | No customer personal data | United States | SOC 2 Type II |
Notes on scope
No language model provider. We have no model provider on this list because none of our products send your inputs to one. Numidian's scoring and settlement math are deterministic and run on our own servers. Holdings tools run entirely on your machine and transmit nothing. If that ever changes, the provider is added here and active customers are emailed 30 days before it takes effect.
Railway and Cloudflare: handle infrastructure and edge security. They have access to network metadata (IP addresses, request paths) but not to the contents of your inputs or outputs except as data passes through their networks in transit.
Stripe: receives payment information directly through Stripe's secure checkout. We do not store full payment card data on our systems. We receive payment confirmation events and customer identifiers from Stripe.
Changes
We may add or replace subprocessors. Material changes are communicated by:
- Updating this page (date and content).
- Emailing active customers and Agency tier contacts at least 30 days before the change takes effect.
- Where required by a Data Processing Addendum signed with a customer, separate notice as specified in that addendum.
Customers may object to a new subprocessor on reasonable grounds. If we cannot resolve the objection, the customer may terminate the affected service and receive a pro-rata refund.
Questions
support@consumerdividends.com