Schemvia Sub-processors
Last updated: 17 October 2026
Version: 1.0
Effective date: 17 October 2026
Schemvia uses service providers to operate its JSON Schema compatibility and evolution service. This register identifies providers that process personal data on behalf of our customers, the functions they perform, and their processing locations.
The Service is operated by Hexlane Systems Ltd, trading as Schemvia. This register accompanies our Data Processing Agreement (DPA). “Customer Personal Data” and “Sub-processor” have the meanings given in the DPA.
1 Sub-processors
The following providers are included in the initial sub-processor register. Their access is limited to the processing needed to provide their services under our instructions and contractual safeguards.
| Provider | Contracted legal entity | Function | Customer Personal Data processed |
|---|---|---|---|
| Render | Render Services, Inc. | Hosting and running the Schemvia web application and API, including anonymous and authenticated analysis. | Submitted schemas, associated project information, analysis inputs and outputs, and related request information processed on the customer’s behalf. |
| Neon | Databricks, Inc. | Hosting the PostgreSQL database used for saved projects, schema versions and analysis history. | Stored schemas, project and version metadata, analysis results and related records, to the extent they contain Customer Personal Data. |
JSON Schemas can contain personal data in descriptions, examples, defaults, enumerated values and other metadata. The particular personal data processed depends on what a customer submits. Customers should use synthetic examples and avoid including personal data that is unnecessary for analysis.
2 Processing locations and transfer safeguards
Render application hosting and the Neon PostgreSQL database are both located in Frankfurt, Germany. The table below also describes backup, support and remote-access locations as published by each provider; these may differ from the primary hosting location. Choosing a European hosting region does not establish that every processing activity takes place within the EU.
| Provider | Primary hosting location | Backup, support and remote-access locations | Transfer safeguards where required |
|---|---|---|---|
| Render | Frankfurt, Germany | As published by Render in the information linked below. | EU Standard Contractual Clauses and UK Addendum, through Render’s DPA. |
| Neon (Databricks, Inc.) | Frankfurt, Germany (AWS eu-central-1) | As published by Databricks in the information linked below. | EU Standard Contractual Clauses and UK Addendum, through Databricks’ DPA. |
Where a transfer requires safeguards under applicable data-protection law, we will put those safeguards in place before the transfer begins, as provided in section 9 of the DPA. For the initial providers listed above, these are the EU Standard Contractual Clauses and the UK Addendum, as incorporated through each provider’s data processing addendum.
Further information about the safeguards applicable to a particular transfer is available from privacy@schemvia.com, subject to appropriate confidentiality and security protections.
Onward processing and location information published by these providers:
- Render: render.com/trust, the list of authorised subprocessors named in Render’s DPA (render.com/dpa).
- Neon (Databricks, Inc.): Databricks sub-processors, a group-wide list that covers Neon services.
These materials supplement this register; they do not replace Schemvia’s obligations under the DPA.
3 Other service providers
Some providers process information for Schemvia’s own account administration, communications, security or billing purposes. That processing is described in our Privacy Policy. A provider’s classification depends on what it actually processes and whose purposes it serves.
| Provider | Service | Relationship to this register |
|---|---|---|
| Clerk | Authentication, identity and session management. | Processing for Schemvia’s own account administration is covered by the Privacy Policy. Where Clerk processes Customer Personal Data on a customer’s behalf, it will be listed in this register. |
| Resend | Transactional email delivery. | Account and service communications may relate to Schemvia’s own purposes. Where Resend processes Customer Personal Data on a customer’s behalf, it will be listed in this register. |
| Sentry | Error monitoring and service observability. | Error reports include a request identifier, HTTP method, status code and URL, and default personal-data collection is disabled. Where Sentry processes Customer Personal Data on a customer’s behalf, it will be listed in this register. |
| Paddle | Merchant-of-record services, checkout, subscriptions, invoicing, taxes and payments. | Paddle independently processes payment and transaction information in its merchant-of-record role. It is not a sub-processor for Customer Personal Data solely because of that role. |
These descriptions do not authorise an unlisted provider to process Customer Personal Data. Where a provider performs both types of processing, its processing on the customer’s behalf is subject to the DPA and must be listed with its legal entity, data categories, locations and relevant safeguards.
Clerk and the other providers in this table are not sub-processors for Customer Personal Data unless their processing on a customer’s behalf is listed above.
4 Changes and customer notices
Under section 8 of the DPA, Schemvia will give customers at least30 days’ advance written notice before an intended addition or replacement of a sub-processor. Notices will be sent to the customer’s designated contact or relevant account email address. Updating this page alone does not replace that notice.
A customer may object within the notice period on reasonable grounds relating to the protection of Customer Personal Data. Send objections toprivacy@schemvia.com, identifying the customer or workspace, the proposed provider and the reasons for the objection.
We will work with the customer in good faith to resolve a timely objection. We will not give the proposed provider access to that customer’s data while the objection remains unresolved. If no reasonable solution is available, either party may end the affected part of the Service before the provider begins processing, with return or deletion of data and any applicable refund handled as set out in the DPA.
Customers should keep their contact information current so that notices reach the appropriate person.
5 Contractual safeguards
Before a sub-processor receives Customer Personal Data, Schemvia will carry out appropriate diligence and enter into a binding written agreement imposing equivalent data-protection obligations for the processing concerned. Schemvia remains responsible to the customer for the sub-processor’s performance of those obligations, as set out in the DPA.
This register provides information about providers and locations. It does not independently vary the DPA or authorise processing outside its scope. Additions, replacements and relevant changes must follow the applicable DPA procedures.
6 Register history
| Version | Date | Description |
|---|---|---|
| 1.0 | 17 October 2026 | Initial version. |
7 Contact
Questions about this register, processing locations or transfer safeguards can be sent to:
Hexlane Systems Ltd
Trading as Schemvia
Email: privacy@schemvia.com