Service providers we use
Running the public site and our internal operations requires these third-party services. We pick vendors with strong security and privacy practices.
Hosting and infrastructure
- AWS (us-east-1) — primary application hosting and Postgres database
- Cloudflare — CDN, DDoS protection, edge caching
Communication
- Resend — transactional email (form submission notifications, password resets on the admin)
- Google Workspace — internal email and document collaboration
Analytics
- Google Analytics 4 — site analytics with IP anonymization
- Plausible Analytics — privacy-respecting alternative analytics
Marketing
- HubSpot — newsletter list (email-only)
All vendors are evaluated against our security and privacy standards before engagement. DPAs signed where applicable.
Updates
If we add or remove a sub-processor, this page is updated. The most recent change is noted at the bottom. Email privacy@ost.agency to subscribe to sub-processor change notifications (typical for enterprise engagements).