Subprocessors
Last updated: 2026-09-18
Meterbox is a data processor under your Data Processing Agreement (DPA). The third parties below are the subprocessors we engage to deliver the service. What they touch depends on the integrations you enable. Material changes are notified at least 30 days in advance per Art. 28(2) GDPR.
Self-Managed tenants: Self-Managed tenants (running Meterbox on their own cluster) have no subprocessors beyond what they configure themselves. Meterbox has no hosted services in the data path. Managed-tier deployments (Meterbox SRE operating a tenant's own cloud account) are a supported deployment option but have no live tenant today; that tier's cloud provider will be added here the day a tenant actually signs up on it.
Billing + payments
Stripe, Inc.
- Purpose
- Payment processing, hosted checkout, subscription billing
- Data processed
- Customer email, name, payment method, invoice amounts, plan id
- Jurisdiction
- United States (SCCs in place)
- Enabled when
- Tenant configures Stripe as billing provider (default)
Transactional email
Resend, Inc.
- Purpose
- Signup verification, password reset, low-balance alerts, MFA, invites
- Data processed
- Recipient email, subject, body (no end-customer PII beyond what the tenant sends)
- Jurisdiction
- United States (SCCs in place)
- Enabled when
- Tenant sets RESEND_API_KEY
Product analytics
Mixpanel, Inc.
- Purpose
- Marketing-site (meterbox.ai) page views and conversion events. Never loaded on the dashboard, never sent for logged-in user activity.
- Data processed
- Session-scoped anonymous id, page path, campaign parameters. No name, email, or account data. The browser never talks to Mixpanel directly, all forwarding happens server-side.
- Jurisdiction
- United States (SCCs in place)
- Enabled when
- MIXPANEL_TOKEN configured (backend-only, server-to-server)
Status page
Instatus, Inc.
- Purpose
- meterbox.ai/status reverse-proxies the hosted status page so the address bar stays on our own domain
- Data processed
- Standard request headers (e.g. user agent) are proxied through; the visitor's real IP address is not forwarded
- Jurisdiction
- United States (SCCs in place)
- Enabled when
- Always, for anyone visiting /status
Google Cloud
Google LLC
- Purpose
- Compute, storage, and KMS for meterbox.ai hosting (the control plane and every Cloud-tier tenant's data-plane pod); also provides native OIDC single sign-on ("Continue with Google")
- Data processed
- All tenant + end-customer data at rest, encrypted (CMEK); for OIDC sign-in, the OAuth authorization code and id_token containing the signing-in user's email
- Jurisdiction
- United States (SCCs in place)
- Enabled when
- Always, for every Cloud-tier tenant (hosting); OIDC sign-in additionally requires GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET configured
Questions about a specific subprocessor or DPA? contact@meterbox.ai.