Subprocessors
The third-party services we use to operate eEndorsements. Each one handles a specific category of customer data and is bound by our data-processing agreement with them.
| Subprocessor | Purpose | Data | Region | BAA |
|---|---|---|---|---|
| Supabase | Primary database (Postgres), authentication, file storage | Account data, Reviews, Surveys, Contacts, Audit logs | AWS us-east-2 (Ohio, USA) | Available on request |
| Vercel | Application hosting, edge network, build pipeline | HTTP traffic, Server logs | Global edge; US primary regions | Available on request |
| Stripe | Subscription billing and payment processing | Billing email, Payment tokens (no card data), Subscription status | United States | Not applicable |
| Resend | Transactional and survey email delivery | Recipient email, Email content, Delivery events | United States | Available on request |
| Telnyx | SMS delivery and inbound webhooks (STOP / HELP handling) | Phone number, Message content, Delivery events | United States | Available on request |
| Upstash | Distributed cache for API rate limiting | Hashed request identifiers (no raw PII) | AWS us-east-1 (Virginia, USA) | Not applicable |
| Google (Places API) | Business location lookup during onboarding | Business name, Address queries | Global | Not applicable |
SupabaseAvailable on request
Primary database (Postgres), authentication, file storage
- Data:
- Account data, Reviews, Surveys, Contacts, Audit logs
- Region:
- AWS us-east-2 (Ohio, USA)
VercelAvailable on request
Application hosting, edge network, build pipeline
- Data:
- HTTP traffic, Server logs
- Region:
- Global edge; US primary regions
StripeNot applicable
Subscription billing and payment processing
- Data:
- Billing email, Payment tokens (no card data), Subscription status
- Region:
- United States
ResendAvailable on request
Transactional and survey email delivery
- Data:
- Recipient email, Email content, Delivery events
- Region:
- United States
TelnyxAvailable on request
SMS delivery and inbound webhooks (STOP / HELP handling)
- Data:
- Phone number, Message content, Delivery events
- Region:
- United States
UpstashNot applicable
Distributed cache for API rate limiting
- Data:
- Hashed request identifiers (no raw PII)
- Region:
- AWS us-east-1 (Virginia, USA)
Google (Places API)Not applicable
Business location lookup during onboarding
- Data:
- Business name, Address queries
- Region:
- Global
We notify customers at least 30 days before adding a new subprocessor by email to the billing contact on the account. Existing customers may object to a new subprocessor by terminating their subscription before the new processor goes live.