Subprocessor schedule.

See the subprocessors that process customer personal data for durin, what each one processes and where, and how changes are notified under the data processing addendum.

Read the DPA Try a sample request

The providers that process customer personal data.

Marathon Digital Pte Ltd., a Singapore company (UEN 202023814G), uses the subprocessors below to provide durin. This schedule is Annex 3 of the data processing addendum (DPA). Customers with a signed DPA receive notice at their privacy contact before a new subprocessor processes their customer personal data.

Cloudflare

Applies: All customers.
Purpose: Hosting and network for the durin website, application, API and gateway: Workers compute, D1 databases, R2 object storage, Durable Objects, secrets storage and email delivery.
Customer personal data: All customer personal data that durin processes, including tool requests and results in transit, membership data, governance metadata, encrypted connection credentials, redacted conversation content when capture is enabled, and recipient addresses for notification and verification emails.
Location: Cloudflare’s global network. durin sets no storage location hint or jurisdiction for its databases, object storage or Durable Objects. [Contracting entity and processing countries to be confirmed by counsel before publish]
Transfer safeguard: [PDPA and GDPR Chapter V transfer mechanism to be confirmed by counsel before publish]

WorkOS

Applies: All customers.
Purpose: Identity: sign-in and sessions, organisation membership and invitation emails, single sign-on and directory sync, and OAuth authorisation for MCP clients.
Customer personal data: Member names and email addresses, roles and memberships, invitations, directory users and groups, session identifiers, and access tokens checked during MCP authorisation.
Location: durin uses the WorkOS API without a region setting. [Contracting entity and processing countries to be confirmed by counsel before publish]
Transfer safeguard: [PDPA and GDPR Chapter V transfer mechanism to be confirmed by counsel before publish]

Sentry

Applies: All customers.
Purpose: Error diagnostics for the durin application, API and gateway.
Customer personal data: Pseudonymous user identifiers, request method and path, selected request headers, error types and stack traces. Request bodies are not sent, and error messages are replaced before an event is sent.
Location: durin sends events to Sentry’s United States ingestion endpoint. [Contracting entity and processing countries to be confirmed by counsel before publish]
Transfer safeguard: [PDPA and GDPR Chapter V transfer mechanism to be confirmed by counsel before publish]

TypeSafe AI

Applies: Only when a customer administrator selects TypeSafe AI policy evaluation and the organisation has not saved its own TypeSafe API key.
Purpose: Optional model-based policy evaluation of governed tool requests and results.
Customer personal data: The exact tool request and, for response checks, the complete upstream result, with the requesting principal, agent client, roles, team and group memberships, team policies and granted scopes. Identity emails, provider tokens and API keys are not included.
Location: durin uses the TypeSafe AI API without a region setting. [Contracting entity and processing countries to be confirmed by counsel before publish]
Transfer safeguard: [PDPA and GDPR Chapter V transfer mechanism to be confirmed by counsel before publish]

OpenRouter

Applies: Only when a customer administrator turns on AI policy drafting for the organisation.
Purpose: Optional drafting of custom policy rules: OpenRouter passes an administrator’s request to a model provider, and durin checks the returned draft before the administrator reviews it.
Customer personal data: The plain-language policy description an administrator writes and the workspace’s connection, tool and client identifiers. Descriptions containing email addresses are refused. Requests deny data collection, require zero-data-retention endpoints and allow no fallback provider, and durin does not store the description or the response.
Location: durin uses the OpenRouter API without a region setting, and OpenRouter forwards each request to a model provider. [Contracting entity and processing countries to be confirmed by counsel before publish]
Transfer safeguard: [PDPA and GDPR Chapter V transfer mechanism to be confirmed by counsel before publish]

How the schedule works.

The schedule forms part of the DPA. These notes explain what it covers and how it changes.

How this schedule applies

A subprocessor is a third party that Marathon engages to process personal data on a customer’s behalf to provide durin. Each entry states when it applies, what the subprocessor processes, where, and the transfer safeguard used under the DPA.

Services you select

Services a customer selects or connects are not subprocessors: the systems and MCP servers connected to durin, a Slack workspace used for approval notifications, export destinations such as Langfuse, a Vanta account an organisation connects for governance evidence, TypeSafe AI used with the customer’s own API key, and agent clients and their model providers. durin sends data to them on the customer’s instructions, and their own terms apply.

Providers for our own purposes

Marathon also uses providers for processing it carries out as a controller or organisation, as described in the privacy notice: Stripe for billing, PostHog for website and application analytics, Crisp for support chat, Sentry for sales inquiries, Cloudflare for form verification, and Google Fonts, which browsers contact to load a typeface. They are outside the DPA’s subprocessor authorisation. [Classification of these providers outside the subprocessor schedule to be confirmed by counsel before publish]

Changes and objections

Under the DPA, Marathon notifies customers at least [subprocessor notice period to be confirmed by counsel before publish] before a new or replacement subprocessor processes their customer personal data, by email to the privacy contact in the signed DPA and by updating this schedule. A customer may object on reasonable data protection grounds by emailing privacy@getdurin.com within the notice period.

International transfers

Subprocessors may process customer personal data outside Singapore and outside the country where a customer is located. Under the DPA, transfers subject to the PDPA are covered by legally enforceable obligations, and transfers subject to the EU GDPR or UK GDPR by a Chapter V transfer mechanism such as the EU standard contractual clauses or the UK Addendum. No EU-only or Singapore-only residency guarantee is offered.

Contacts

Send subprocessor and transfer questions to privacy@getdurin.com. General questions go to contact@getdurin.com.

Questions about subprocessors.

Is every provider durin uses a subprocessor?

No. Only providers that process personal data on a customer’s behalf to provide durin are subprocessors. Providers Marathon uses for its own billing, analytics, sales and support are described in the privacy notice, and services a customer selects or connects are governed by that customer’s own arrangements.

How will we hear about a new subprocessor?

Customers with a signed DPA receive an email at their privacy contact before a new or replacement subprocessor processes their customer personal data, and this schedule is updated. Email privacy@getdurin.com to change that contact.

Questions about a subprocessor?

Email privacy@getdurin.com about a listed subprocessor, a transfer safeguard, or the privacy contact that receives change notices under your DPA.

Email privacy