Compute and database
Control-plane hosting, European runtime capacity, and managed data storage.
SUBPROCESSORS
Named providers, not mystery infrastructure.
This page identifies third parties authorized to process customer personal data while helping Small provide the service. A provider is listed only after the actual production choice is configured.
Current provider list
No provider is represented as a production subprocessor while Small remains a local private alpha. The production contract requires at least one named, reviewed provider and rejects placeholder entries.
DNS and edge
Public DNS, TLS termination, application ingress, and abuse protection.
Transactional email
Email verification, password recovery, and workspace invitations.
Billing
Subscription checkout, invoices, tax, and payment status.
Monitoring and recovery
Off-host availability signals, incident alerts, and encrypted backups.
How changes are handled
Small evaluates providers for their role, access, security, processing locations, deletion behavior, and contractual protections. Customers will receive reasonable advance notice of a new subprocessor where the applicable data processing addendum requires it, including a process for raising a documented data-protection objection.
Customer-managed infrastructure
A cloud or VPS provider selected and contracted directly by a customer for a customer-owned runtime is not appointed by Small as Small's subprocessor merely because the Small node software runs there. The customer remains responsible for that provider relationship. Small providers used by the control plane are still listed above.
Data Processing Addendum
The Data Processing Addendum has not yet been published. Production validation requires a public HTTPS document before launch.