Subprocessors
These are the third-party services Evelmo relies on to operate. Each has access only to the infrastructure-level data necessary for their role. None of them train on, analyze, or repurpose your audit-log data.
Compute (Cloud Run), secrets management (Secret Manager), scheduled jobs (Cloud Scheduler), logging.
Location: us-central1 (Iowa, USA)
Database hosting. Stores your audit events, organization data, API key hashes. Encrypted at rest; TLS in transit.
Location: us-central1 (Iowa, USA) — colocated with compute
Frontend hosting and edge delivery for evelmo.com and the dashboard.
Location: Global edge network (cached at the nearest PoP)
Authentication, organization management, session tokens. SOC 2 Type II certified.
Location: United States
Changes
We will notify existing customers at least 30 days in advance of any change to this subprocessor list — adding, removing, or changing the role of any entity listed above. Customers can object to new subprocessors in writing; if we cannot accommodate the objection, the affected customer may terminate without penalty.
Questions
For DPAs, security due diligence questionnaires, or specific processing questions, email security@evelmo.com. The standard DPA is published at /dpa; Business-plan customers can request signed DPA and BAA as part of their contract — see the pricing page.
Last updated: April 19, 2026