Subprocessors
Service providers that process personal data on our behalf for the website/waitlist (and — once released — the mobile app). Generated from the vendor registry (src/lib/compliance/vendors.ts) so it cannot drift from code. Only assessed roles are publicly asserted.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Current subprocessors (live table below)
Supabase — managed PostgreSQL + object storage — waitlist/contact/consent records — US (region to confirm) via AWS infra — DPA https://supabase.com/legal/dpa — mechanism SCCs/DPF VERIFY + TIA pending — retention per retention-matrix — deletion via service-role + backup lifecycle — CONTRACTED — last reviewed 2026-10-02 — LEGAL REVIEW REQUIRED.
Clerk — authentication/identity — email/name/ID/session — US — DPA https://clerk.com/legal/dpa — mechanism SCCs/DPF VERIFY + TIA pending — retention until account deletion — deletion via Clerk API — CONTRACTED — last reviewed 2026-10-02 — LEGAL REVIEW REQUIRED.
Hosting/CDN — transit metadata — Cloudflare (Workers + global edge; region list per Cloudflare) — DPA acceptance + TIA PENDING — not publicly asserted until assessed.
No email/CRM/support/analytics/marketing/AI provider is integrated. Adding one requires vendor review (data/purpose/role/country/subprocessors/DPA/security/transfer/retention/deletion/contract/last-reviewed/legal-review) before it processes data.
2. Role classification, contracts and transfers
Role is unclassified until a signed DPA establishes processor status — we do not publicly claim 'processor' without verification. Transfer mechanism + safeguards + assessment per transfer-register.md; adequacy/SCCs/IDTA/BCRs/consent/contract as applicable per jurisdiction (see Privacy Policy Section 15). Subprocessors of subprocessors (e.g. AWS for Supabase) are disclosed where the vendor discloses them.
3. Changes and notice
We update this list before a new provider processes data and, where required (enterprise/B2B, or where local law requires advance notice), give advance notice with an objection/termination path. Version 0.9.0-draft, last updated 2026-10-02. Full registry fields: vendor/service/data/purpose/role/country/subprocessors/DPA/security/transfer/retention/deletion/contract/last-reviewed/legal-review (see SubprocessorTable component).
Sources
This document is derived from the following entries in our legal source registry: EU-GDPR, UK-GDPR, IN-DPDP, BR-LGPD, INT-SCC. See for the full citations and the date each source was last verified.
Current subprocessors
| Provider | Service | Data | Location | Role |
|---|---|---|---|---|
| Supabase | Managed PostgreSQL database and object storage | Waitlist signup data, Contact messages, Consent evidence records | United States (project region to be confirmed) | Under review |
| Clerk | Authentication and identity | Email address, Name, Clerk user identifier, Session metadata | United States | Under review |
We do not name a provider as a processor until its role and transfer mechanism have been verified. Where that review is pending it is shown above rather than assumed.