Misfora uses one sub-processor for personal data processed through the Web Scanner SDK and the OCR API: Railway, which hosts the application, the database and its backups. Misfora gives clients at least 10 days' notice before adding or replacing a sub-processor.
Sub-processors
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Railway Corporation | Application hosting, database, database backups, platform logs | EU West — Amsterdam, Netherlands (application, database, backups); United States (platform logs) | Document images in memory during processing; technical request metadata; client IP addresses and request times in platform logs (up to 90 days) |
Transfers to the United States for platform logs are governed by Railway's Data Processing Agreement, signed between Misfora and Railway, which incorporates the EU Standard Contractual Clauses (and the UK Addendum). Railway's own sub-processors, including its cloud infrastructure providers, are listed at trust.railway.com.
Services that do not process end-user data
These services support Misfora's operations but receive no document images, recognized data or end-user identifiers from the SDK or the OCR API.
| Service | Use | Data it receives |
|---|---|---|
| Cloudflare | DNS for misfora.com (no proxying of SDK traffic) | DNS queries only |
| Resend | Email to client contacts (API key setup links, notices, security alerts to the administrator) | Client contact email addresses; no end-user data |
| GitHub | Private source code repository, dependency security checks | Source code; no personal data |
| ImprovMX | Email forwarding for misfora.com addresses (for example security@misfora.com) | Messages sent to Misfora addresses; no end-user data |
| UptimeRobot | Availability monitoring | Responses of public health and SDK script endpoints |
| Google Analytics, Microsoft Clarity | Analytics on Misfora's marketing pages only | Visitors of misfora.com marketing pages; not loaded by the SDK, its demo page or the scanning interface |
Analytics or other tools that a client adds to its own pages are the client's responsibility.
Changes
| Date | Change |
|---|---|
| 2 November 2026 | First version |
A Data Processing Agreement for the Web Scanner SDK and OCR API is available on request: partners@misfora.com. Report security issues to security@misfora.com. See also the Privacy Policy.