Last updated 2026-09-06
Sub-processors
These are the third parties ActivityPulse engages to deliver the service, what each one processes, and where. The list is short because the platform runs almost entirely on one provider — which is deliberate, and usually the fastest part of a security review.
Current sub-processors
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, per-organisation databases, object storage for raw archives, queues, and transactional email delivery. | All captured activity metadata, account data and transactional email content. | United States by default. From the Teams plan an organisation's database can be placed in United States — East, United States — West, Asia-Pacific or Oceania. The control plane — account and organisation records — remains in the United States. |
| Google LLC (Google Analytics) | Aggregate usage measurement on the public marketing pages only. The analytics tag is not loaded in the signed-in application, so no captured activity, and no organisation, team, user or project identifier, is ever sent to it. | Marketing-site page views, approximate location, device and referrer. | United States. |
| Google LLC | Optional sign-in with Google, where an organisation chooses to enable it. | Email address and basic profile fields, at sign-in only. | United States. |
| Google LLC (favicon service) | Fetching the small logo shown beside a website in reports. Our servers request it, not your browser, and only the first time any customer's data mentions that website — the image is then cached and served from our own storage. Nothing identifying your organisation, team, users or devices is sent, and no request is made from a monitored device. | The domain name of a website, e.g. “github.com”. No account, organisation, device or person is identified, and no timing or duration is sent. | United States. |
| Stripe, Inc. | Subscription checkout, payment processing, invoicing and the customer billing portal, for paid plans only. Stripe is the record of the payment relationship; we do not see or store card details. | The billing administrator's email address, the organisation identifier, the plan and seat count, and whatever billing and payment details are entered at checkout. No captured activity, and no team, user, device or project identifier, is sent. | United States. |
| Microsoft Corporation | Optional sign-in with Microsoft, where an organisation chooses to enable it. | Email address and basic profile fields, at sign-in only. | United States. |
| LinkedIn Corporation | Optional sign-in with LinkedIn, where an organisation chooses to enable it. | Email address and basic profile fields, at sign-in only. | United States. |
The three sign-in providers are engaged only where an organisation chooses to enable that sign-in method, and they see an email address and basic profile fields at sign-in — never captured activity.
Notice of changes
We give notice before adding or replacing a sub-processor. Customers may object on reasonable data protection grounds, as set out in the data processing agreement.
To be notified of changes, email contact@activitypulse.ai.