Last updated: March 2026
Cargoman uses the following third-party services to provide our private Composer registry. We notify customers via email at least 30 days before engaging new sub-processors. For full details on our data processing practices, please refer to our Data Processing Agreement.
| Provider | Purpose | Data Processed | Location | Legal Basis |
|---|---|---|---|---|
| RapidSwitch (iomart Managed Services Limited) | Dedicated colocation (compute, database hosting) | All customer data, packages, tokens | United Kingdom | UK GDPR, UK-EU adequacy decision |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, WAF | IP addresses, request metadata, headers | Global edge (EU processing config) | EU-US DPF Certified |
| Cloudflare R2 | Object storage (packages) | Package archives, metadata | Frankfurt, Germany | EU-US DPF Certified |
| Provider | Purpose | Data Processed | Location | Legal Basis |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Billing email, payment method, billing address, transaction history | United States | EU-US DPF Certified, PCI DSS Level 1 |
| Amazon Web Services (SES) | Transactional email | Email address, name | Frankfurt, Germany | EU-US DPF Certified, EU SCCs |
| Google LLC (Analytics) | Website analytics | Anonymised usage data, cookies (with consent) | United States | EU-US DPF Certified, Consent |
| Google LLC (reCAPTCHA) | Bot protection (contact form) | IP address, browser data | United States | EU-US DPF Certified, Legitimate Interest |
To receive notifications about changes to our sub-processor list, email [email protected] with the subject "Subscribe to Sub-Processor Updates".
| Date | Change |
|---|---|
| March 2026 | Initial sub-processor list published |