X-TKN Subprocessor List

Last Updated: October 14, 2026

Version: 1.3

Fennec LLC uses the third parties below to run X-TKN. This list is referenced by the X-TKN Privacy Policy and by our Data Processing Addendum.

Current subprocessors

Amazon Web Services

  • Purpose: Compute, database, object storage, CDN, and outbound email (SES).

  • What it can reach: All stored data, including payloads. An encrypted payload reaches AWS as ciphertext we hold no key to.

  • Location: United States. The API, database, file storage and email run in us-west-2 (Oregon); the website's static pages are held in us-east-1 and served through CloudFront.

Stripe

  • Purpose: Subscription billing and payment processing.

  • What it can reach: Account email, billing details, and subscription state. Card numbers go to Stripe directly and never reach us.

  • Location: United States, with global processing.

Google — Firebase Authentication

  • Purpose: Account sign-in for the console.

  • What it can reach: Email address and authentication identifiers.

  • Location: United States.

Google — reCAPTCHA Enterprise

  • Purpose: Abuse prevention on the forms that send a sign-in link (which is how an account is created) and on the contact form.

  • What it can reach: IP address and browser signals, on those forms only.

  • Location: United States.

What is not on this list

Printful appears in Fennec Studio's storefront subprocessor set and has no involvement in X-TKN. No X-TKN data reaches it.

We use no analytics, advertising, session-replay, or error-reporting vendor on X-TKN. The retrieval page in particular calls nothing but our own API.

Google Fonts serves the typefaces on most other pages of x-tkn.com, so it receives a visitor's IP address and browser details when one of those pages loads. It receives no account data, no API traffic, and nothing from the retrieval page.

Encryption and what a subprocessor can actually see

Every payload reaches us encrypted, and the decryption key is either in a URL fragment that is never transmitted, or in your own keystore. No subprocessor on this list receives it. AWS stores ciphertext.

Two paths produce that ciphertext, and they differ in who does the encrypting. A secret created in the X-TKN console is encrypted in your browser before it is sent, with the key placed in the link fragment rather than in any request. A payload sent to the API is encrypted by you, and the API refuses one that is not an encrypted envelope.

One thing still reaches AWS in readable form: readable data you wrap in an xtkn.v1r envelope yourself, which we cannot tell apart from ciphertext.

Notice of changes

We will publish an update here before a new subprocessor begins processing customer data, and will email account holders who have asked for notice. If you object to a new subprocessor on reasonable data-protection grounds, tell us within thirty days of the notice and we will either propose an alternative or let you terminate the affected service without penalty.

To be added to the notification list, write to support@fennec.studio.

Change log

  • 1.3 — 2026-09-25 — Encryption section updated: the API's envelope check now applies to

every account, with no per-account allowance during an integration's move-over, so the only readable data that reaches AWS is data you wrap in an xtkn.v1r envelope yourself.

  • 1.2 — 2026-09-23 — AWS location corrected: the API, database, storage and email run in

us-west-2, and only the static site is in us-east-1. reCAPTCHA's scope corrected to every emailed sign-in link and the contact form, not signup alone. Google Fonts noted. Encryption section rewritten for the cutover, after which the API refuses a payload that is not an encrypted envelope.

  • 1.1 — 2026-09-20 — Encryption section rewritten: the console now seals a secret in the

sender's browser by default, so "encryption is your choice and is not applied for you" was only ever true of the API path.

  • 1.0 — 2026-09-01 — Initial publication.