Legal
Subprocessors
Last updated: 23 October 2026
1. Our subprocessors
These providers process personal data on Kleio's behalf. Each is bound by a written data processing agreement. Our Data Processing Agreement explains how we add or change them.
| Provider | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Railway Corporation | Hosting: application servers, database, cache and logs | All data Kleio stores, including store data and account data | Virginia, United States | EU-U.S. Data Privacy Framework |
| Clerk, Inc. | Sign-in and team management | Name, email address, profile picture, organisation membership, and the IP address and device of each sign-in | United States | EU-U.S. Data Privacy Framework |
| Cloudflare, Inc. (through Clerk) | Bot protection at sign-in | IP address, browser signals | Global network | EU-U.S. Data Privacy Framework |
| Resend | Sending scheduled report emails | Recipient email addresses, report contents | United States | EU-U.S. Data Privacy Framework |
| Google LLC (Google Workspace) | Our email, including support correspondence | What you write to us and your email address | United States | EU-U.S. Data Privacy Framework |
| Slack Technologies, LLC | Internal alerts to our team about errors and abuse | User email address and browser type in error alerts; IP address in abuse alerts | United States | EU-U.S. Data Privacy Framework |
2. Services you connect
Kleio also exchanges data with services you choose to connect, such as Shopify, Meta, Google Ads, TikTok, Snapchat, Pinterest, Microsoft Advertising, AppLovin, Klaviyo, ShipHero, GoAffPro, Google Sheets, Slack and the AI assistant you use with Kleio. These are not our subprocessors: you have your own agreement with each of them, and Kleio reads from or sends to them only at your direction.
3. Changes to this list
We email the account owner of every Kleio organisation at least 10 days before adding or replacing a subprocessor, and update this page. A change that is urgent, for example for security, may be made first and announced as soon as we can. You can object as described in our Data Processing Agreement.
4. Where the infrastructure is
Kleio is operated by MFvAS2 ApS, a company established in Denmark and subject to EU law. The infrastructure that stores and processes customer data (servers, database and cache) is located in Virginia, United States, and operated by Railway Corporation, a US company.
5. Protection against government access
Because our infrastructure is in the United States, US authorities could request access to data. If we or a subprocessor receive a request from any government authority for your data, we will:
- check that it is lawful and challenge it if it is not;
- disclose only the minimum the request lawfully requires;
- tell you about it before disclosing anything, unless the law forbids us;
- refuse requests from non-EU authorities that conflict with EU or Danish law, unless an international agreement requires us to comply.
Access tokens are encrypted at rest, and AI-agent tokens are stored only as one-way hashes.