Last updated: June 2026
Coursfy uses the following subprocessors to deliver the platform. This list is incorporated by reference into our Data Processing Agreement (DPA) for business customers.
We notify customers of material subprocessor changes per the DPA.
| Vendor | Purpose | Data location | Safeguards |
|---|---|---|---|
| MongoDB Atlas | Primary application database (user profiles, academies, courses, transactions) | EU/EES (e.g. eu-central-1 Frankfurt) — configurable per deployment | DPA + SCCs where applicable; encryption at rest and in transit |
| Amazon Web Services (Amplify, S3, CloudFront) | Frontend hosting, media storage, CDN | EU regions (eu-north-1 / eu-central-1) for production when configured | AWS DPA; SSE for S3; TLS in transit |
| Stripe | Payments, subscriptions, Stripe Connect creator payouts | EU/US — Stripe processes per merchant configuration | Stripe DPA; PCI DSS; minimal card data on Coursfy servers |
| Sentry (optional) | Error monitoring when analytics consent granted | EU data residency available on Business plan | PII scrubbing via scrubSentryEvent; consent-gated load |
| Transactional email provider | Account verification, notifications | EU/EES preferred; confirm per deployment | DPA; purpose-limited message content |