Subprocessors
This page supplements our Privacy Policy. The same register is versioned in repository documentation at docs/legal/subprocessors.md for audits and counsel review.
Processors in use
These vendors process personal data on our instructions. Data Protection Addendums (DPAs) and, where applicable, HIPAA Business Associate Agreements are executed under counsel guidance; signed PDFs live outside this website and are tracked in internal systems (see Linear SG-105).
| Vendor | Purpose |
|---|---|
| Supabase | Authentication, PostgreSQL database with Row Level Security, file storage metadata, and realtime delivery. |
| Stripe | Payment processing, invoices, and fraud prevention services as provided by Stripe. |
| Resend | Transactional and operational email delivery. |
| Zoom | Video interpretation sessions — meeting metadata and participant identifiers as required to host conferences. |
| Geoapify | Mapping and geocoding for logistics where those product features are enabled. |
| Vercel | Application hosting, edge delivery, and privacy-oriented web analytics (essential Web Vitals / traffic aggregates) for the Next.js deployment. |
| Upstash | Redis-backed rate limiting for authentication and mutation routes (client IP addresses may be processed transiently). |
| Sentry | Error and performance monitoring — captures stack traces and user identifiers subject to our observability scrubbing policy. |
| VirusTotal | Optional malware scanning for uploaded files (file hashes and metadata sent when VIRUSTOTAL_API_KEY is configured). |