CMS Legal
Sub-processor List
Third-party providers Aspire 2: CMS uses to host, secure, authenticate, bill, email, and measure the platform.
Last updated: 2 June 2026. We aim to notify tenants 30 days before adding material new sub-processors.
| Provider | Purpose | Location Notes |
|---|---|---|
| Cloudflare | Workers hosting, D1 database, R2 media storage, KV, DNS, CDN, security, Turnstile. | United States and global infrastructure. |
| WorkOS | Authentication, user management, sessions, password reset, organisation/account identity. | United States. |
| Stripe | Billing, subscriptions, checkout, customer portal, invoices, payment lifecycle events. | Australia, United States, and global payment infrastructure. |
| Resend | Transactional email delivery, including lead notifications and account lifecycle email. | United States. |
| PostHog | Admin product analytics where accepted, and server-side aggregate public site events. | United States by default unless reconfigured. |
Notice Of Changes
For material new sub-processors, Aspire aims to give tenants at least 30 days' notice by email or platform notice before the provider is used in production, unless urgent security, legal, or operational needs require faster action.