Sub-processors

Last changed: October 2026

These are the providers Auradonors uses to run the service that receive personal data. Each is bound by a data protection agreement. We email organizations at least 30 days before adding a new one.

DigitalOcean

What it does: Hosting the application and its managed databases
What it receives: All of an organization's data, unless the organization hosts its own database
Where: United States (New York)

Cloudflare

What it does: The network in front of our hosting, and bot checks on public forms
What it receives: Traffic as it passes through; IP address for bot checks
Where: United States and worldwide network

Postmark (ActiveCampaign)

What it does: Delivering email
What it receives: Each recipient's name and email address, and the email's content
Where: United States

Sentry (Functional Software)

What it does: Error monitoring
What it receives: Error details, the signed-in user's id, page addresses and short log lines; never form contents or keys
Where: United States

Smarty

What it does: Address checking, when an organization turns it on
What it receives: Street addresses only, never names
Where: United States

Google Fonts and jsDelivr

What it does: Delivering the application's font and text-editor files to users' browsers
What it receives: Users' IP address and browser details
Where: Worldwide network

Provider	What it does	What it receives	Where
DigitalOcean	Hosting the application and its managed databases	All of an organization's data, unless the organization hosts its own database	United States (New York)
Cloudflare	The network in front of our hosting, and bot checks on public forms	Traffic as it passes through; IP address for bot checks	United States and worldwide network
Postmark (ActiveCampaign)	Delivering email	Each recipient's name and email address, and the email's content	United States
Sentry (Functional Software)	Error monitoring	Error details, the signed-in user's id, page addresses and short log lines; never form contents or keys	United States
Smarty	Address checking, when an organization turns it on	Street addresses only, never names	United States
Google Fonts and jsDelivr	Delivering the application's font and text-editor files to users' browsers	Users' IP address and browser details	Worldwide network

Services an organization connects itself

An organization can connect its own accounts with other services: a payment processor (Stripe or Authorize.Net), shipping (ShipStation), sales tax (Avalara), an email list (Mailchimp), an address-change processor, or its own systems through webhooks. These are the organization's providers, not ours. We send each the information it needs on the organization's instruction, and the organization's agreement with that provider governs it.

Questions: [email protected]. See also our privacy policy.