← Back to home

Subprocessors

Last updated: 21 September 2026

These are the third parties that process personal data on behalf of suppp customers. We sign a data processing agreement with each of them. We give customers at least 30 days' notice before adding or replacing a subprocessor, so they can object (see our Data Processing Agreement).

ProviderPurposeLocationTransfer safeguard
Supabase Inc.Database, authentication and file storageData: All account and customer data (conversations, contacts, attachments)EU — Frankfurt, Germany (AWS eu-central-1)Data stays in the EU; DPA with SCCs for support access
Vercel Inc.Application hosting, serverless functions, cookieless website analyticsData: All data passing through the application; request logsEU — Frankfurt, Germany (functions); global CDN for static filesEU-US Data Privacy Framework + SCCs
Resend Inc.Transactional email (sign-in links, invites, notifications)Data: Recipient email address, name, email contentUSAEU-US Data Privacy Framework + SCCs
Stripe Payments Europe Ltd.Subscription billing and paymentsData: Billing contact, payment details (card data never touches our servers)Ireland / USAEU-US Data Privacy Framework + SCCs
Anthropic PBCAI summaries and suggested replies — only when a workspace admin enables AI featuresData: Content of the analysed conversation (last 20 messages) and the customer's name/emailUSASCCs in Anthropic's DPA; API data is not used for model training
Google LLCSign in with Google; Gmail integration when a customer connects a Gmail inboxData: Account email/name; emails in the connected inboxUSA / EUEU-US Data Privacy Framework + SCCs
Microsoft CorporationOutlook / Microsoft 365 integration when a customer connects an Outlook inboxData: Emails in the connected inboxUSA / EUEU-US Data Privacy Framework + SCCs

Stay informed

Want to be notified of changes to this list? Email hello@suppp.chat with the subject "Subprocessor updates". Workspace admins are also notified by email.