Sub-processors List
Last updated: 25 September 2026
The vendors listed below process personal data on behalf of cepaos LLC under their respective Data Processing Agreements (DPA). This list is part of our DPA and is kept up to date. Customers will be notified at least 30 days in advance of any material change.
| Name | Role | Data categories | Location | Transfer basis | Vendor policy |
|---|---|---|---|---|---|
| Stripe, Inc. | Payment processing (non-LATAM markets, including Portugal) | Billing contact, Tax ID, Tokenised card reference | United States (Ireland for EU customers) | SCC + EU-U.S. DPF | stripe.com |
| Dlocal LLP | Payment processing (LATAM: AR, BR, CL, MX, UY) | Billing contact, Tax ID, Tokenised card reference | United Kingdom (contracting entity, England and Wales); processing also in the countries where dLocal operates, incl. local acquirers in the payer's country | EU adequacy decision (UK, 2021/1772) + SCC | www.dlocal.com |
| Supabase, Inc. | Managed PostgreSQL database, authentication and object storage | Account data, Operational data inserted by the customer, Auth tokens | Brazil (AWS sa-east-1, São Paulo) | EU adequacy decision (Brazil, 2026/179) + SCC | supabase.com |
| Resend, Inc. | Transactional email delivery | Email address, Email content metadata | United States | SCC | resend.com |
| Sentry (Functional Software, Inc.) | Application error monitoring (with PII scrubbing) | IP address, User identifier, Stack traces | United States | SCC | sentry.io |
| Cloudflare, Inc. | CDN, DNS and DDoS protection | IP address, Request metadata | Global edge network (anycast) | SCC + EU-U.S. DPF | www.cloudflare.com |
| Amazon Web Services, Inc. | Underlying infrastructure (via Supabase) and selected archival storage | Encrypted database backups | Brazil (sa-east-1, São Paulo) — underlying the Supabase database | EU adequacy decision (Brazil, 2026/179) + SCC | aws.amazon.com |
| Upstash, Inc. | Redis cache and rate-limiting | Session identifiers, Rate-limit counters | European Union (AWS eu-central-1, Frankfurt) | Within EU/EEA | upstash.com |
| Anthropic, PBC | Large Language Model API for AI-assisted features (e.g. compliance watchdog summarisation) | Public regulatory text, Aggregated, anonymised operational summaries | United States | SCC | www.anthropic.com |
| Railway Corp. | Application hosting and deployment platform | Request logs, Application runtime metadata, IP address (transient) | United States (us-west2) | SCC | railway.app |
| PostHog, Inc. | Product analytics and feature flag delivery | Pseudonymous user identifier, Page views and product events, IP address (truncated) | European Union (eu.i.posthog.com, Frankfurt) | Within EU/EEA | posthog.com |
| Google LLC (Google Analytics 4) | Web/product analytics and conversion tracking (client-side + server-side Measurement Protocol) | IP address (truncated/anonymised), Page views and events, Pseudonymous client identifier, Conversion metadata (plan, country, MRR) | United States | SCC + EU-U.S. DPF | policies.google.com |
| ZeroBounce LLC | Email validation (deliverability checks of lead and user email addresses) | Email address | United States | SCC | www.zerobounce.net |
| Loops, Inc. | Marketing & lifecycle email (onboarding sequences and campaigns) | Email address, Name, Product event metadata | United States | SCC | loops.so |
| Qik Innovations Pvt Ltd (OpenSign) | Electronic signature platform for B2B contracts, NDAs and one-shot business documents (ad-hoc use) | Signer name and email, IP address and user agent at signature, Signature image / drawn signature, Timestamp and audit trail, Document content (may contain personal data depending on the signed document) | India (hosted SaaS at opensignlabs.com; EU instance at eu-app.opensignlabs.com — residency not contractually guaranteed) | SCC (pending signature) | www.opensignlabs.com |
Upcoming sub-processors
The vendors below have been notified to customers and will only process personal data from the date shown. Until that date they are not part of the list above.
| Name | Effective from | Role | Data categories | Location | Transfer basis | Vendor policy |
|---|---|---|---|---|---|---|
| Groq LLC | October 25, 2026 | Speech-to-text transcription of voice notes (server-side dictation) | Voice recordings of users who use server-side dictation, Resulting transcript text | United States | SCC | console.groq.com |
For questions, contact privacy@cepaos.com