Legal
Subprocessors
Version 2026-08-subprocessors-2 · Effective 2026-08-17
The third parties Clause50 uses to help provide the service.
Subprocessors
These are the third parties we currently use, or plan to use, to provide the service.
| Subprocessor | Purpose | Data categories | Data location | Transfer basis | Status |
|---|---|---|---|---|---|
| Vercel | Application hosting / edge | All request data in transit; platform request logs | Functions pinned to fra1 (Frankfurt, EU) | Contracting entity Vercel Inc. is US-established (Delaware); its DPA states its primary processing facilities are in the United States — covered by EU Standard Contractual Clauses (2021, Modules One–Three) and the UK IDTA, binding automatically on acceptance of Vercel's Terms | Active subprocessor |
| Supabase (managed PostgreSQL) | Primary database | Account, system, evidence, and artifact metadata | AWS eu-central-1 (Frankfurt, EU) | Contracting entity Supabase, Inc. is US-established. Its DPA is incorporated by reference into Supabase's Terms of Service (no separate signature required) — the specific ex-EEA transfer mechanism has not been independently verified from that text | Active subprocessor |
| Cloudflare R2 (object storage) | Evidence and artifact object storage | Uploaded evidence bytes; generated documents | Cloudflare EU jurisdiction — objects are stored and served only from EU data centres, a hard placement guarantee | Contracting entity Cloudflare, Inc. is US-established; its DPA covers any ex-EEA transfer of account/billing metadata (distinct from the R2 object bytes themselves) via EU SCCs or Cloudflare's EU-U.S. Data Privacy Framework certification | Active subprocessor |
| Resend | Transactional email (sign-in links, alert digests, one-off free-scan results) | Recipient email address; message content | Sending region eu-west-1 (Ireland, EU) | Contracting entity Plus Five Five, Inc. (San Francisco) is US-established and its DPA §6.1 states its primary processing occurs in the United States — covered by EU Standard Contractual Clauses (Module Two) and Resend's EU-U.S. Data Privacy Framework certification | Active subprocessor — DPA incorporated by reference on account creation (Resend's Terms of Service), no separate signature required |
| Gotenberg (hosted on Render) | DOCX → PDF conversion of generated artifacts | Full document bytes, transiently, during conversion | Workload runs in Render's Frankfurt (EU Central) region | Contracting entity Render Services, Inc. (San Francisco) is US-established and its DPA §6.1 states its primary processing occurs in the United States — covered by the EU-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as the contractual fallback | Active subprocessor — third-party-hosted, so document bytes leave our own infrastructure during conversion |
| Polar Software, Inc. | Payment processing and merchant of record (checkout, invoicing, VAT/tax remittance, chargebacks) | Billing/payment details, name, email, billing address, purchase history | Processes payments globally, including for EU customers | US-established | Active subprocessor and merchant of record for paid plans |
| Stripe | Payment processing infrastructure underlying Polar (sub-subprocessor — we have no direct relationship with Stripe) | Billing/payment details, processed on Polar's behalf | Global, on Polar's behalf — we have no direct relationship with Stripe to confirm further | US-established | Active sub-subprocessor (via Polar) |
Customer-directed integrations — not our subprocessors
GitHub, OpenAI, and Anthropic are not Clause50 subprocessors. When you connect one of these, you supply your own credential and we read data back from your own account on your instruction — the relationship is between you and that vendor, not us.
Changes to this list
We will update this page, and notify customers with a signed DPA, before adding a new subprocessor — not after.