Trust Center · Subprocessors
Subprocessors
Third-party vendors that process customer data on our behalf. We assess every subprocessor annually and require a Data Processing Agreement aligned with GDPR Article 28 before granting access.
Last updated 2026-10-22 · 15 active subprocessors
critical tier · 3
| Vendor | Purpose | Data categories | Residency | Certifications | DPA |
|---|---|---|---|---|---|
| Stripe, Inc. | Payment processing | identity, financial, contact | United States | PCI-DSS Level 1 · SOC 2 Type II · GDPR | ✓ in place |
| Supabase Inc. | Primary database, authentication, file storage, realtime | identity, contact, financial, location, behavioral, communications | United States (us-east-1) | SOC 2 Type II · HIPAA-eligible · GDPR | ✓ in place |
| Vercel Inc. | Application hosting, edge network, serverless compute | identity, contact, behavioral | United States (global edge) | SOC 2 Type II · GDPR · ISO 27001 | ✓ in place |
high tier · 5
| Vendor | Purpose | Data categories | Residency | Certifications | DPA |
|---|---|---|---|---|---|
| Anthropic, PBC | AI synthesis for Groundcheck trust reports | identity, behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| GitHub, Inc. (Microsoft) | Source code repository | behavioral | United States | SOC 2 Type II · ISO 27001 · GDPR | ✓ in place |
| Inngest Inc. | Background job orchestration | identity, behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| Resend (Buttondown LLC) | Transactional email | contact, communications | United States | SOC 2 Type II · GDPR | ✓ in place |
| Twilio Inc. | SMS messaging (transactional + dispatch) | contact, communications | United States | SOC 2 Type II · GDPR · HIPAA-eligible | ✓ in place |
medium tier · 6
| Vendor | Purpose | Data categories | Residency | Certifications | DPA |
|---|---|---|---|---|---|
| Axiom, Inc. | Application log retention | behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| Functional Software, Inc. (Sentry) | Error monitoring and observability | behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| Google LLC (Generative AI) | Image generation for visualizer feature | identity, behavioral | United States | SOC 2 Type II · ISO 27001 · GDPR | ✓ in place |
| OpenAI, OpC LLC | AI synthesis fallback | behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| PostHog, Inc. | Product analytics | behavioral | United States | SOC 2 Type II · GDPR | ✓ in place |
| Upstash, Inc. | Redis (rate limiting, ephemeral cache) | behavioral | United States | SOC 2 Type II · GDPR | in negotiation |
low tier · 1
| Vendor | Purpose | Data categories | Residency | Certifications | DPA |
|---|---|---|---|---|---|
| Cloudflare, Inc. | DNS, edge protections (via Vercel) | behavioral | Global edge | SOC 2 Type II · ISO 27001 · GDPR | ✓ in place |