Sub-Processor List
Annex 3 to the Data Processing Addendum · Last updated 26 September 2026
Meridian engages the third parties listed below to process Customer Content or personal data. Customers may subscribe to changes to this list, and Meridian gives 30 days' notice of additions and replacements as provided in the Data Processing Addendum.
A. Sub-processors with access to Customer Content
| Sub-processor | Purpose | Processing location | Data accessed |
|---|---|---|---|
| Railway Corporation (United States) | Cloud hosting, compute, managed PostgreSQL database and storage for the Service | EU West — Amsterdam, Netherlands | All Customer Content; account and usage data |
| Google LLC — Google Cloud Platform | Underlying infrastructure on which Railway operates | Netherlands | All Customer Content, as infrastructure provider to Railway |
Railway holds SOC 2 Type 2, SOC 3, HIPAA and GDPR certifications and is certified under the EU-US Data Privacy Framework. Its Data Processing Agreement incorporates the EU Standard Contractual Clauses. Railway's SOC 2 report and penetration-test report are available to Meridian's customers under confidentiality on request.
B. Sub-processors with access to other personal data
| Sub-processor | Purpose | Processing location | Data accessed |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Authentication and single sign-on | United States | Account identifiers, username, email address |
| Functional Software, Inc. (Sentry) | Error and crash monitoring | European Union | Diagnostics, stack traces, limited identifiers |
| LaunchDarkly, Inc. | Feature-flag management | European Union | Account identifiers |
| Airwallex (Israel) Limited | Payment processing, hosted checkout and invoicing | Israel | Billing contact and company details. Card data is entered directly with Airwallex and never reaches Meridian |
| Google (Google Workspace) | Business email and support correspondence | Global (Google data centres) | Support correspondence and contact data |
C. Downstream sub-processors engaged by Railway
Railway engages its own sub-processors in operating its platform. As published in its trust centre these are Cloudflare (edge networking), Fathom Analytics, Causal, Customer.io and Stripe. Of these, Cloudflare sits in the network path for traffic to the Service; the remainder relate to Railway's own business operations rather than to Customer Content.