LEGAL · SUBPROCESSOR LIST

Subprocessor List

Third-Party Services That Process Customer Data

Document ID: NSS-LEGAL-SUBPROC-001 · Version: 1.0 — May 2026 · Classification: Confidential · Contact: legal@northstarshowsystems.com

Table of contents

  1. 1. PURPOSE
  2. 2. CURRENT SUB-PROCESSORS
  3. 3. SERVICES THAT DO NOT PROCESS PERSONAL DATA
  4. 4. NOTIFICATION OF CHANGES
  5. 5. DOCUMENT HISTORY

1. PURPOSE

This document lists the third-party sub-processors that Northstar Show Systems engages to process Customer Personal Data in connection with providing Northstar products and services. This list is maintained pursuant to the Data Processing Agreement (NSS-LEGAL-DPA-001) and is updated whenever sub-processors are added or removed.

2. CURRENT SUB-PROCESSORS

ProviderServiceData ProcessedLocationDPA/SCCs
Cloudflare, Inc.CDN, DNS, WAF, DDoS protection, edge compute (Workers, D1, R2, Pages)IP addresses, HTTP headers, request logs, session data, database recordsGlobal (300+ data centers)Cloudflare DPA + SCCs
Stripe, Inc.Payment processingBilling name, email, payment method tokens (Northstar never stores full card numbers)United StatesStripe DPA + SCCs
Amazon Web Services / MailgunTransactional email deliveryEmail addresses, email content (ticket notifications, password resets, invoices)United StatesAWS/Mailgun DPA
Google LLCWebsite analytics (Google Analytics 4)Anonymized IP, page views, browser/device type, geographic regionUnited StatesGoogle DPA + SCCs
GoDaddyDomain registration and DNS (primary)WHOIS data (registrant contact)United StatesGoDaddy DPA

3. SERVICES THAT DO NOT PROCESS PERSONAL DATA

The following services are used by Northstar but do not process Customer Personal Data:

ProviderServiceWhy No Personal Data
ArduinoHardware platform (UNO R4 WiFi)Firmware runs locally; no data transmitted to Arduino
GL.iNetTrueNorth router hardwareAir-gapped network; no cloud connection
ASUSHelm NUC hardwareLocal compute only; no ASUS cloud services
GitHubSource code hosting (internal)No customer data in repositories
npm / Node.jsSoftware package manager / runtimeBuild tools only; no customer data

4. NOTIFICATION OF CHANGES

Northstar will notify customers at least 30 days before engaging a new sub-processor or materially changing the scope of an existing sub-processor’s engagement. Notification is provided via:

  • Email to the Org Admin of each customer organization.
  • Announcement in the Customer Portal.
  • Update to this document (published at the URL below).

Customers may object to a new sub-processor within 30 days of notification per DPA Section 7.

5. DOCUMENT HISTORY

VersionDateChange
1.0May 2026Initial publication

DOCUMENT CROSS-REFERENCES:

  • Data Processing Agreement (NSS-LEGAL-DPA-001)
  • Privacy Policy (NSS-LEGAL-PP-001)

Questions about this policy?

Reach our legal team at legal@northstarshowsystems.com.

All policies