/docs/privacy/subprocessors
Subprocessors
Version 2026-03-16-v23, updated 2026-03-16.
| Service | Purpose | Role | Location / Region | Transfer Safeguards |
|---|---|---|---|---|
| Supabase | Hosting, database, authentication, storage, and realtime capabilities | Currently processor | EU (Frankfurt / Central EU) | Current primary data region is EU (Frankfurt / Central EU); where third-country processing occurs, appropriate safeguards such as SCCs apply |
| Vercel | Web hosting, deployment, and CDN/edge infrastructure | Currently processor | Active hosting and edge infrastructure with EU footprint; global delivery and US involvement may occur depending on the request | Where third-country processing occurs, in particular through global edge or analytics functions, appropriate safeguards such as SCCs apply |
| Stripe | Payment processing, billing, customer portal, and webhook handling for active paid services | Independent controller for its own payment, compliance, and fraud-prevention processes; contractually integrated recipient for technical contract fulfillment | US/EU | Where third-country processing occurs, appropriate safeguards such as SCCs apply |
| Google OAuth | Single sign-on and transfer of permitted profile data, in particular email address, display name, and profile image where provided by the provider | Independent controller | Global, commonly US | Provider-specific transfer mechanisms, e.g. SCCs or adequacy decisions |
| GitHub OAuth | Single sign-on and transfer of permitted profile data, in particular email address, display name, and profile image where provided by the provider | Independent controller | Global, commonly US | Provider-specific transfer mechanisms, e.g. SCCs or adequacy decisions |
| SMTP mail infrastructure (currently: www103.your-server.de) | Transactional email, support, and system communication | Currently technical communications service / processor | Currently via the configured SMTP host www103.your-server.de; the hosting infrastructure assigned to that host is decisive | Where third-country processing occurs, appropriate safeguards such as SCCs apply; the infrastructure assigned to the currently configured SMTP host is decisive |
| OpenRouterOptional | Routing and processing of optional AI requests | Recipient for optional AI features; downstream model providers vary by routing | US, with possible global sub-processors | Provider-specific safeguards, e.g. SCCs; sub-processors vary by model routing |
| Google AI StudioOptional | Processing optional AI requests | Recipient for optional AI features | US | Provider-specific safeguards, e.g. SCCs |