Subprocessors and transfers
Version 1 · in force since Oct 15, 2026
⚠️ Draft for legal review. The highlighted fields must be filled in before there are paying customers.
The companies that help us provide the service, where the data is and with what safeguards.
1. List
| Who | What for | Where the data is | Safeguard for outside the EU |
|---|---|---|---|
| Supabase Inc. | Database, accounts, files and realtime | Ireland (EU) | Data processing agreement with standard contractual clauses (for support access) |
| Vercel Inc. | Hosting of the site and server functions | Dublin (Ireland, EU); global delivery network | Data processing agreement; EU-US Data Privacy Framework or standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Sending the app’s emails | United States | Standard contractual clauses |
| Anthropic PBC | Artificial intelligence features, only when the organization uses them | United States | Standard contractual clauses; data is not used to train models |
| GitHub Inc. (Microsoft) | Code integration, only when the organization connects it (read-only) | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc. (Turnstile) | Checking that whoever signs in or creates an account is a person (protection against automated attacks); processes the network address and technical browser data | Global network, including the United States | EU-US Data Privacy Framework and standard contractual clauses |
2. Changes
We email each organization’s owner 30 days before adding a new subprocessor. The organization may object on reasoned grounds, and end the service at no cost if there is no alternative.