Legal
Paybond Subprocessors
1. Overview
Paybond uses subprocessors and infrastructure providers to deliver the hosted service. The exact providers used for a customer may depend on plan, service environment, region, enabled settlement rails, SSO or SCIM configuration, and customer-directed integrations.
2. Core subprocessors
| Provider | Purpose |
|---|---|
| Cloudflare | Domain routing, TLS, web security filtering, rate limiting, bot filtering, request metadata, and edge protection for public Paybond domains. |
| Fly.io | Application hosting and runtime infrastructure for Paybond services. |
| Supabase | Managed database infrastructure for product, account, billing, and operational records. |
3. Conditional providers
| Provider | Purpose |
|---|---|
| Stripe | Self-serve subscription billing, checkout, customer portal, invoices, payment-method handling, billing webhooks, and Stripe Connect settlement workflows where enabled. |
| Coinbase CDP Payments | x402 USDC on Base payment-session and settlement rail operations where that rail is enabled for a tenant. |
| Amazon Web Services | Transactional email delivery for sign-in and operational messages when email sending is configured. |
4. Customer-directed integrations
Some third parties process data because the customer configures them, not because Paybond centrally embeds that provider for every customer. These may include:
- Payment and settlement rail providers you connect with your own merchant credentials, such as Shopify, Adyen (Checkout), Flutterwave, or Paystack, when you enable and configure that rail for your workspace.
- OIDC or SAML identity providers such as Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, or another standards-compliant IdP.
- SCIM provisioners or HR systems that connect to Paybond provisioning surfaces.
- Observability or logging tools selected by the customer.
- Model, agent, orchestration, or workflow services used by customer applications or examples outside the core Paybond hosted service.
For these rails, Paybond stores the destination credentials you provide (encrypted) so Harbor can authorize and settle intents on your behalf, and Paybond receives webhook events from that provider to drive settlement state. Paybond does not choose or contract with these providers for you, and your relationship and compliance obligations with each provider are your own.
5. Changes and notice
Paybond may update this list as providers, service architecture, regions, or service features change. Contract-managed customers may request subprocessor notice terms or data processing terms through [email protected].