Providers & subprocessors

Website and enquiry infrastructure

Vercel Inc. — website hosting, API execution, deployment and security logs. Marketing functions are configured in Frankfurt; global delivery and support can involve other regions. Terms: https://vercel.com/legal/dpa and https://vercel.com/legal/sub-processors.

Supabase — database and operator authentication. Application database configured in EU Central (Frankfurt). Provider backups, support and auth logs require their own retention review. Terms: https://supabase.com/legal/dpa and https://supabase.com/legal/subprocessors.

Resend — transactional delivery to operators, including sign-in links. New-request notifications carry a UUID and workspace link; no form contents or requester reply-to address. Operator email delivery still processes the operator address. Terms: https://resend.com/legal/dpa.

Cloudflare — domain registration and DNS. It is not represented here as a proxy processing every application request. Its role and data flows depend on enabled services. Terms: https://www.cloudflare.com/cloudflare-customer-dpa/.

Product monitoring is a separate scope

Railway, model providers, scraping providers and customer-selected notification channels may be involved in a contracted monitoring configuration. They are not automatically recipients of website form contents. Before activation, the contract annex must name the providers actually enabled, their processing purpose, regions, retention and transfer safeguards. Unused fallback providers are not presented as active subprocessors.

Ask the privacy contact for the applicable provider list and safeguards. Any processor appointment or subprocessor change must follow the agreed DPA, including the agreed notice and objection process. This list does not by itself prove that every contract annex and transfer assessment has been signed.