Subprocessors
This translation is provided for convenience. The English version is the authoritative text.
Last updated: September 8, 2026
This page is the current, canonical list of the third parties uploadthefile.com uses to provide the Service. It exists so that customers who act as data controllers can see, at a single URL, every party that may process personal data on their behalf, and so that changes to that list are announced in one predictable place, as our Data Processing Terms promise.
1. Subprocessors for your content
Under Section 7 of the Data Processing Terms, you give us general authorization to engage subprocessors that may process Covered Content, meaning personal data in the files you upload and visitor data collected by features you configure. We impose data-protection obligations on each of them consistent with the Data Processing Terms. The current Covered-Content subprocessors are:
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Supabase | Database, file storage, and authentication | US / EU (region per deployment) |
| Cloudflare | Hosting, CDN, Workers compute, Workers AI inference (for the PDF-chat feature), image downscaling and video frame extraction for automated content moderation, CSAM scanning, and DNS/registrar | Global edge network |
| Google Safe Browsing | URL threat screening | US |
| urlscan.io | URL analysis | EU |
| VirusTotal | File-hash reputation (admin-triggered) | US |
Document conversion (Gotenberg) runs on infrastructure we operate ourselves and is not a third-party subprocessor. Our internal operations alerting tools receive only minimal controller data (such as an account identifier and event type) and never Covered Content, so they are not Covered-Content subprocessors either.
2. Service providers for our own processing
Separately, we use the following providers for the processing we carry out as an independent controller, covering account, billing, email, sign-in, and analytics data, as described in our Privacy Policy. They are listed here for transparency; they are not Covered-Content subprocessors under the Data Processing Terms.
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Supabase | Database, storage, and authentication for account data | US / EU (region per deployment) |
| Cloudflare | Hosting, CDN, and compute for the Service itself | Global edge network |
| Resend | Transactional email (team invites, billing and account notices) | US |
| Polar | Billing, checkout, and subscription management | US |
| Sign-in with Google, and Google Analytics (loaded only with your cookie consent) | US | |
| Ahrefs | Cookieless website analytics on our marketing pages (no cookies, no cross-site tracking; raw IP addresses are discarded and never stored) | Singapore (entity) / US (storage) |
| GitHub | Sign-in with GitHub | US |
| Microsoft | Sign-in with Microsoft | US |
3. How we announce changes
When we add or replace a subprocessor, we update this page and record the change in the log below before the new subprocessor processes Covered Content, giving you the opportunity to object as described in Section 7 of the Data Processing Terms (by deleting the affected content or closing your account). If you need to monitor this list (for example, for your own Article 28 records), check this page or contact us at contact@uploadthefile.com and we will answer questions about upcoming changes.
4. Change log
- September 8, 2026: Corrected the Cloudflare purpose: Workers AI serves PDF chat only; the Images-binding downscale and Media Transformations frame extraction support moderation.
- August 26, 2026: Added Ahrefs (Ahrefs Pte. Ltd.) as a service provider for our own controller processing: cookieless website analytics on our marketing pages. It is not a Covered-Content subprocessor: it runs only on pages we publish, never on customer-published content, and it receives no uploaded files. It sets no cookies and stores nothing on your device.
- July 17, 2026: Initial publication of this page. It lists the Covered-Content subprocessors already disclosed in the Data Processing Terms, and adds the service providers used for our own controller processing.
5. Contact
Questions about this list or our subprocessor relationships? Email contact@uploadthefile.com.