| Sub-processor | Service | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Edge hosting, CDN, DNS, WAF, DDoS protection | Network metadata, request logs | Global edge, US headquartered |
| Supabase, Inc. | Managed Postgres database, authentication, file storage | Account data, Customer Content, auth metadata | US (default region) |
| Stripe, Inc. | Payments, subscription billing, tax calculation, fraud prevention | Billing identifiers, payment method tokens, tax identifiers | US, EU |
| OpenAI, LLC | AI text and embedding generation | Prompts and Customer Content submitted to AI features (zero-retention API where available) | US |
| Google LLC (Gemini API) | AI text, multimodal, and image generation | Prompts and Customer Content submitted to AI features | US, EU |
| Resend, Inc. | Transactional email delivery | Recipient email, subject, message body | US |
| Google LLC (Analytics 4) | Website analytics | Pseudonymous usage data, IP truncated | US |
| PostHog, Inc. | Product analytics and session telemetry | Pseudonymous usage data, feature events | US, EU |
We will provide at least 30 days' prior notice before adding or replacing a sub-processor. See Section 6 of the DPA for objection rights.