{"version":"2026.07.07","publishedAt":"2026-07-07","subprocessors":[{"name":"Supabase, Inc.","purpose":"Primary application database, Auth (OAuth/SSO), object storage.","dataCategories":["account","authentication credentials (hashed)","tenant business data","audit logs"],"region":"EU-West (Frankfurt) / eu-central-1","dpa":"https://supabase.com/legal/dpa","lastReviewed":"2026-04-12"},{"name":"Vercel, Inc.","purpose":"Application hosting, edge network, serverless functions.","dataCategories":["IP address","user-agent","request metadata"],"region":"EU (fra1)","dpa":"https://vercel.com/legal/dpa","lastReviewed":"2026-04-12"},{"name":"Stripe Payments Europe, Ltd.","purpose":"Subscription billing, invoicing, tax compliance.","dataCategories":["billing address","tax id","payment method (tokenised)","invoice line items"],"region":"Ireland (EEA) + USA (SCCs Module 4)","dpa":"https://stripe.com/legal/dpa","lastReviewed":"2026-03-21"},{"name":"OpenAI Ireland Ltd.","purpose":"LLM inference (GPT-4 class) for AI features when routed to OpenAI.","dataCategories":["prompt content","user-supplied context"],"region":"Ireland (EEA) — opted out of training","dpa":"https://openai.com/policies/data-processing-addendum","lastReviewed":"2026-05-02"},{"name":"Anthropic, PBC","purpose":"LLM inference (Claude class) for AI features when routed to Anthropic.","dataCategories":["prompt content","user-supplied context"],"region":"USA (SCCs) — opted out of training, 30-day retention","dpa":"https://www.anthropic.com/legal/data-processing-addendum","lastReviewed":"2026-05-02"},{"name":"OpenRouter, Inc.","purpose":"Multi-model LLM gateway for cost-optimised inference.","dataCategories":["prompt content"],"region":"USA (SCCs)","dpa":"https://openrouter.ai/privacy","lastReviewed":"2026-05-02"},{"name":"Resend (Drip, Inc.)","purpose":"Transactional email delivery (workspace invites, password reset, drip).","dataCategories":["email address","name","message body"],"region":"EU + USA (SCCs)","dpa":"https://resend.com/legal/dpa","lastReviewed":"2026-04-30"},{"name":"Functional Software, Inc. (Sentry)","purpose":"Error + performance telemetry for application code.","dataCategories":["error message","stack trace","anonymous user id"],"region":"EU (Frankfurt)","dpa":"https://sentry.io/legal/dpa/","lastReviewed":"2026-04-12"},{"name":"Langfuse GmbH","purpose":"AI request tracing for prompt + latency observability.","dataCategories":["prompt content","model output","trace metadata"],"region":"EU (Frankfurt)","dpa":"https://langfuse.com/security","lastReviewed":"2026-04-30"},{"name":"Mistral AI SAS","purpose":"LLM inference (Mistral models) — default for DSGVO-strict workspaces.","dataCategories":["prompt content","model output"],"region":"EU (France)","dpa":"https://mistral.ai/terms/#data-processing-agreement","lastReviewed":"2026-07-07"},{"name":"Upstash, Inc.","purpose":"Redis cache, BullMQ job queues, rate-limit counters.","dataCategories":["session metadata","queued job payloads (transient)"],"region":"EU (Frankfurt)","dpa":"https://upstash.com/trust/dpa.pdf","lastReviewed":"2026-07-07"},{"name":"Railway Corp.","purpose":"Worker compute for BullMQ workflow consumers and long-running jobs.","dataCategories":["workflow step payloads (in transit / transient)"],"region":"EU (Amsterdam)","dpa":"https://railway.com/legal/dpa","lastReviewed":"2026-07-07"},{"name":"Amazon Web Services EMEA SARL","purpose":"Encrypted database backups, customer file storage (S3), key management (KMS).","dataCategories":["encrypted DB backups","file objects"],"region":"EU (eu-central-1, Frankfurt)","dpa":"https://aws.amazon.com/compliance/gdpr-center/","lastReviewed":"2026-07-07"},{"name":"Cloudflare, Inc.","purpose":"DDoS protection + WAF in front of orconic.com (Vercel-managed).","dataCategories":["IP address","request metadata"],"region":"Global anycast","dpa":"https://www.cloudflare.com/cloudflare-customer-dpa/","lastReviewed":"2026-04-12"}]}