This version is no longer in force. It was replaced by version 2026.3, effective Sep 06, 2026. Read the current Sub-processors.
Sub-processors
Who this is for: anyone who wants to know which other companies handle data so that MetroPay can work.
The companies that handle data for us
MetroPay cannot deliver an invoice, take a card payment or stay online by itself. These are the providers that make it work, what each one sees, and where it operates.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| DigitalOcean | Runs the application, the database and file storage | All application data | Bangalore, India |
| Postmark | Delivers invoices, reminders and statements | Recipient name and email, message content, delivery and open events | United States |
| Stripe | Card payments into each business's own Stripe account | Payer name, email, amount, and card details which are held by Stripe and never by us | United States |
| SSLCommerz | Card and mobile payments in Bangladeshi taka | Payer name, email, phone, amount | Bangladesh |
| Cloudflare | Serves and protects our pages, and issues certificates for custom domains | IP addresses and request metadata, in transit | Global edge network |
| Laravel Nightwatch | Tells us when the application errors or slows down | Request paths, timings and error traces — no customer records | Operated by Laravel |
Thirty days' notice before we add one
We will publish any addition to this list here at least 30 days before it starts handling data. That window exists so you can object on data protection grounds, or leave, before anything changes.
If we ever have to replace a provider at short notice — because one fails, or is withdrawn — we will say so here and explain why the notice period could not be met.
What is deliberately not on this list
No advertising network. No marketing platform. No data broker. No third-party analytics script on our pages by default.
Product measurement, when a person switches it on, is the only optional collection MetroPay does, and what it collects is described in the Privacy Policy and on the Cookies page.
Contact
Questions about this list go to [email protected].