Trust · Sub-processors
Sub-processors
The service providers Mule uses, with location and transfer safeguards.
- Version
- 2026-10
- Status
- Draft, pending counsel review
- Last updated
- 17 October 2026
Mule uses these service providers to host and run client systems, the Mule Portal and this website. Each is bound by a data processing agreement. Regions marked "choice" are set per client in the Order Form. We give clients 30 days' notice before adding or replacing a sub-processor. To be told of changes, use Portal settings or email juastins@icloud.com.
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, functions, edge network, web analytics | Application data in transit; logs | US; EU region by choice | DPA with SCCs |
| Supabase Inc. | Postgres database, file storage, backups | Client data, Portal data | US or EU (Frankfurt) by choice | DPA with SCCs |
| Clerk Inc. | Sign-in, multi-factor authentication, user management | Names, emails, sign-in events | US | DPA with SCCs |
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payments, invoices, tax calculation | Billing contacts, payment data | US, Ireland | DPA; independent controller for fraud and legal duties |
| Resend | Transactional and project update email | Recipient emails, message content | US | DPA with SCCs |
| Upstash Inc. | Job queues, rate limiting | Job metadata, IP addresses for rate limits | US or EU by choice | DPA with SCCs |
| Cloudflare, Inc. | DNS, bot protection on forms | IP address, browser signals | Global | DPA with SCCs |
| Anthropic PBC | AI drafting and summarizing of messages and documents, with human review | Message and document content | US | Commercial terms with no training on customer content; DPA with SCCs |
| Mapbox, Inc. | Maps and routing, only for systems with maps | Location points shown on maps | US | DPA |
| Apple Inc. (iCloud Mail) | Receipt of email sent to juastins@icloud.com | Correspondence | US | Apple's standard iCloud terms |
Staff locations: Mule's team works from the United States (Wisconsin, Michigan, Ohio), Belgium and Spain. Access to client systems follows the security measures in the DPA.
Not sub-processors: Google, LinkedIn and Meta receive data only from visitors who accept marketing on www.mule.sh, as independent controllers under their own terms. They never receive client data.
Also in trust
Questions about this page: juastins@icloud.com. A postal or other non-electronic channel is available on request.