Trust Center

Sub-processors

Last updated: May 9, 2026 · Version 1.0

These are the third-party service providers we use to deliver McPortal. Each processes only the minimum data needed to perform its function. Customers who sign our DPA authorize the list below at signature.

Sub-processorPurposeData categoriesLocation
NeonServerless Postgres — primary databaseAll customer and user data, including encrypted OAuth tokensUnited States
CloudflareWorkers runtime for the MCP server endpoint and TLS terminationOAuth tokens (decrypted in memory only during a tool call), tool-call payloads in transitGlobal edge network
VercelHosting for the web dashboardRequest logs, browser session dataUnited States
StripeSubscription billing and paymentsBilling email, customer ID, subscription status. Card data is collected directly by Stripe and never touches McPortal.United States
ResendTransactional email — sign-in links, invitations, billing noticesEmail address, magic-link tokensUnited States
GoogleIdentity provider for Google sign-in (only if a user chooses Google sign-in)Email, name, profile photo URLGlobal

Notice of changes

We will give at least 30 days’ prior notice before adding a new sub-processor or materially changing how an existing one processes customer personal data. Customers under our DPA may object during the notice period; if we cannot accommodate the objection, you may terminate the affected portion of the service.

To receive change notices by email, subscribe at trust@orchestrategies.com. We also update the “last updated” date and version on this page with every change.

What we do not consider sub-processors

  • Integrations you connect (Slack, GitHub, Google Workspace, Microsoft 365, Jira, Linear, Asana, Monday.com, Dropbox, etc.). These are independent third-party services that you, as the controller, instruct us to access on your behalf. They are not sub-processors of McPortal.
  • LLM providers called by your end users (Anthropic, OpenAI, etc.). McPortal does not invoke LLMs on your behalf; the model client your team uses calls McPortal.

Related