Legal
Subprocessors
Third-party services that process data on behalf of Drip to provide our metered billing infrastructure.
Overview
This page lists the third-party subprocessors that Drip uses to provide its metered billing infrastructure services. Each subprocessor is categorized by function and includes a description of the data it processes. Pilot and production customers may request a Data Processing Agreement (DPA) detailing specific data handling obligations by contacting legal@drippay.dev.
Infrastructure & Hosting
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Vercel | Dashboard hosting and deployment (Next.js frontend) | Web traffic, session data, static assets | United States |
| PostgreSQL (self-hosted or managed) | Primary relational database | All application data: customers, usage events, charges, settlements, accounts, audit logs | Varies by deployment |
| Redis / Valkey | In-memory cache and message queue | Payment proof replay protection, distributed locks, rate limiting counters, job queues | Varies by deployment |
Blockchain & On-Chain Settlement
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Base (Coinbase L2) | Layer 2 blockchain network for on-chain settlement | Settlement transactions, security deposits, smart contract state (wallet addresses, amounts) | Decentralized |
| Blockchain RPC Provider | JSON-RPC access to Base / Base Sepolia | Transaction submissions, balance queries, contract calls, event indexing | Varies by provider |
| Basescan (Etherscan) | Block explorer and contract verification | Smart contract source code, ABI data, transaction hashes | United States |
| Circle (USDC) | USDC stablecoin issuer | Token transfer amounts, wallet addresses (via USDC contract on Base) | United States |
Authentication & Identity
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Privy | Wallet-based authentication and embedded wallets for the dashboard | User identity, linked accounts, embedded wallet addresses, authentication tokens | United States |
| WalletConnect | Wallet connection protocol (used via Privy integration) | Wallet addresses, connection metadata | Decentralized |
Email & Notifications
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Resend | Transactional email delivery | Recipient email addresses, email content (dispute notifications, low balance alerts, settlement confirmations, team invitations, statement delivery) | United States |
Monitoring & Error Tracking
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Sentry | Application error tracking, performance monitoring, and profiling | Error stack traces, request metadata, performance traces, IP addresses (when sendDefaultPii is enabled) | United States |
Background Job Processing
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| BullMQ (library, uses Redis/Valkey) | Background job queue for async charge processing, settlement batching, and webhook delivery | Job payloads containing charge data, settlement parameters, webhook delivery metadata | Self-hosted (runs on your Redis/Valkey instance) |
Notes
Blockchain RPC Provider is configurable via the BLOCKCHAIN_RPC_URL environment variable. The specific provider (Alchemy, Infura, QuickNode, Ankr, etc.) depends on your deployment configuration.
PostgreSQL and Redis/Valkey can be self-hosted or use managed services (e.g., AWS RDS, ElastiCache, Render Postgres) depending on your deployment environment.
BullMQ is an open-source library that runs within Drip's backend process and uses the same Redis/Valkey instance — it is not a separate hosted service.
All on-chain data (wallet addresses, transaction hashes, settlement amounts) is publicly visible on the Base blockchain by design.
Change notifications: Any material changes to this subprocessor list will be reflected by updating the "Last Updated" date at the top of this page. Customers with a DPA in place will receive email notification of material changes.