Sub-processors
Last verified: 4 October 2026.
This list belongs with the privacy policy and Annex C of the data processing agreement. A customer has the right to object to a new sub-processor, so adding a party is a change customers are told about in advance.
| Party | Processing | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, document storage | EU (Sweden, Stockholm) | n/a |
| Vercel | Application hosting | EU (Sweden, Stockholm) | n/a |
| Resend | Sending email | EU | n/a |
| DeepL | Translating instructions and messages | EU | n/a |
| Stripe | Payments and billing | Not yet established | Not yet established |
| OpenAI | Transcribing voice messages (switched off today, see below) | United States | Standard Contractual Clauses |
Vercel's edge network is global. The static marketing pages can be cached closer to the visitor, including outside the EU. Those pages hold no personal data — they are sales copy. The application, all data and all logic run in Stockholm.
OpenAI is not used today. Speech-to-text is switched off, so nothing goes to the United States. The row above exists so the basis is already in place for the moment a customer turns that feature on. A customer who never wants that stays within the EU regardless: an EU alternative is available.