Legal · Sub-Processors
Sub-Processors
The third-party vendors that MigrationFox Inc. engages to deliver the cloud-migration service. Each is contractually bound under our standard Data Processing Agreement to handle data only on our instructions and to maintain security standards equivalent to ours.
Last updated: 2026-05-19
Active sub-processors
| Sub-processor | Purpose | Data category | Region |
|---|---|---|---|
| Oracle Cloud Infrastructure | Migration worker (file content streaming) | File content (in-transit only; not retained) | Canada Southeast (Toronto) |
| Railway | API hosting, Postgres database, Redis queue | Operational metadata, audit logs, encrypted credentials | United States (us-west-2) |
| Vercel | Static landing site, web app, docs site hosting | No customer data (presentation layer only) | Global edge network |
| Stripe | Payment processing, subscription billing | Billing contact, payment method, invoices | United States |
| Resend | Transactional email (password reset, receipts, notifications) | User email addresses, message bodies | United States |
| Sentry | Error tracking and performance monitoring | Application errors, stack traces (PII scrubbed) | United States |
| Microsoft Azure (optional) | Trusted Signing for desktop installer signature | Installer binary hashes only | Canada Central |
Customer file content streams through Oracle Cloud Toronto only and is not retained after migration completes. Operational metadata (file paths, sizes, audit logs, AES-256-encrypted credentials) lives on Railway in the US, accountable to MigrationFox Inc. under PIPEDA.
Sub-processor change notice
Customers receive at least 30 days advance notice by email to the designated contact before MigrationFox adds or replaces a sub-processor that processes Customer Data.
If a customer reasonably objects to a new sub-processor on grounds related to data protection, the parties discuss in good faith. If no resolution is reached within 30 days, the customer may terminate the affected service component for cause.
Subscribe to updates
To be notified of changes to this list, email privacy@migrationfox.com from your designated billing or security contact, requesting addition to the sub-processor notification list.
Customers with a signed DPA in place are added to the notification list automatically using the contact details on the DPA.
International transfers
Canada (Oracle Cloud). Canada is recognized by the European Commission as providing adequate protection for personal data (Adequacy Decision 2002/2/EC). Transfers from EEA/UK to Canada do not require additional safeguards.
For Sub-Processors located in the United States (Railway, Stripe, Resend, Sentry), MigrationFox incorporates the Standard Contractual Clauses (Module 3: Processor to Sub-Processor) approved by the European Commission Implementing Decision (EU) 2021/914 into its agreements with those Sub-Processors. The populated Annex is available on request via privacy@migrationfox.com.