Principles / Subprocessors
Subprocessors.
Third parties that process customer data on our behalf under a written agreement. Updated quarterly.
Last reviewed: April 2026
| Name | Role | Region | Terms |
|---|---|---|---|
| Supabase | Managed Postgres, authentication, row-level security Tenant databases are dedicated on the Advisor and Firm tiers. | US (us-east-1) or EU (eu-west-2) by tenant election | Agreement → |
| Anthropic | Frontier-model inference (default) Documents are never used to train a model. ZDR is the contract default. | US, under zero-retention enterprise agreement | Agreement → |
| Voyage AI | Embeddings provider for retrieval over uploaded documents Embeddings are generated from chunk text at ingest time. Inputs are not retained by the provider and are not used to train any model. | US, under zero-retention enterprise agreement | Agreement → |
| Amazon Web Services | Compute, storage, networking; Bedrock PrivateLink on the Advisor tier Object Lock is used for audit-log retention. CMK available on Advisor and Firm tiers. | Region pinned per tenant (us-east-1, eu-west-2, eu-central-1, ap-southeast-1) | Agreement → |
| Vercel | Application hosting and edge delivery for the marketing surface No customer documents traverse the marketing origin. | Global edge, origin region pinned per tenant | Agreement → |
| Resend | Transactional email (magic-link sign-in, partner notifications) Email content is limited to authentication links and engagement status. | US | Agreement → |
| Stripe | Invoicing and payment processing (post-engagement) Invoices are issued after a master services agreement is signed. Checkout is not used. | US and EU | Agreement → |
| Sentry | Error telemetry, with PII scrubbing Document contents are never forwarded to Sentry. | US or EU per tenant | Agreement → |
| PostHog | Product analytics on non-PII events Events contain no document content, no email addresses, and no House names. | EU (eu.posthog.com) | Agreement → |
Any change to this list is communicated to active Houses by email before it takes effect, with a fifteen-business-day window for objection. The full data-processing agreement, including subprocessor change procedure, is available on request before any document is uploaded.