Status: production draft. Keep current before signing enterprise contracts. Last reviewed: 2026-07-08.
| Subprocessor | Purpose | Data categories | | --- | --- | --- | | Vercel | Hosting, serverless runtime, runtime logs, web analytics, speed insights | Account metadata, request metadata, application logs | | Neon or managed Postgres provider | Application and auth database | Workspace metadata, evidence metadata, audit logs, user records | | Stripe | Billing, checkout, customer portal, subscription webhooks | Billing contact details, payment/subscription metadata | | Google | Optional OAuth login when enabled | OAuth account identifier, email, profile name |
No support, warehouse, messaging, or external error-tracking subprocessor is included in the current Vercel-only operations model.
Material subprocessor changes should be recorded before customer notice is sent where a signed DPA or order form requires notice. Optional providers are not approved for production customer data until their purpose, data categories, and contract status are added to this list.