Lista de Subcontratantes
Última atualização: 25 de setembro de 2026
Os fornecedores listados abaixo tratam dados pessoais por conta da cepaos LLC ao abrigo dos respectivos Acordos de Tratamento de Dados (DPA). A lista é parte integrante da nossa DPA e é mantida actualizada. Os clientes serão notificados com pelo menos 30 dias de antecedência sobre qualquer alteração material.
| Nome | Função | Categorias de dados | Localização | Base de transferência | Política do fornecedor |
|---|---|---|---|---|---|
| Stripe, Inc. | Payment processing (non-LATAM markets, including Portugal) | Billing contact, Tax ID, Tokenised card reference | United States (Ireland for EU customers) | SCC + EU-U.S. DPF | stripe.com |
| Dlocal LLP | Payment processing (LATAM: AR, BR, CL, MX, UY) | Billing contact, Tax ID, Tokenised card reference | United Kingdom (contracting entity, England and Wales); processing also in the countries where dLocal operates, incl. local acquirers in the payer's country | EU adequacy decision (UK, 2021/1772) + SCC | www.dlocal.com |
| Supabase, Inc. | Managed PostgreSQL database, authentication and object storage | Account data, Operational data inserted by the customer, Auth tokens | Brazil (AWS sa-east-1, São Paulo) | EU adequacy decision (Brazil, 2026/179) + SCC | supabase.com |
| Resend, Inc. | Transactional email delivery | Email address, Email content metadata | United States | SCC | resend.com |
| Sentry (Functional Software, Inc.) | Application error monitoring (with PII scrubbing) | IP address, User identifier, Stack traces | United States | SCC | sentry.io |
| Cloudflare, Inc. | CDN, DNS and DDoS protection | IP address, Request metadata | Global edge network (anycast) | SCC + EU-U.S. DPF | www.cloudflare.com |
| Amazon Web Services, Inc. | Underlying infrastructure (via Supabase) and selected archival storage | Encrypted database backups | Brazil (sa-east-1, São Paulo) — underlying the Supabase database | EU adequacy decision (Brazil, 2026/179) + SCC | aws.amazon.com |
| Upstash, Inc. | Redis cache and rate-limiting | Session identifiers, Rate-limit counters | European Union (AWS eu-central-1, Frankfurt) | Within EU/EEA | upstash.com |
| Anthropic, PBC | Large Language Model API for AI-assisted features (e.g. compliance watchdog summarisation) | Public regulatory text, Aggregated, anonymised operational summaries | United States | SCC | www.anthropic.com |
| Railway Corp. | Application hosting and deployment platform | Request logs, Application runtime metadata, IP address (transient) | United States (us-west2) | SCC | railway.app |
| PostHog, Inc. | Product analytics and feature flag delivery | Pseudonymous user identifier, Page views and product events, IP address (truncated) | European Union (eu.i.posthog.com, Frankfurt) | Within EU/EEA | posthog.com |
| Google LLC (Google Analytics 4) | Web/product analytics and conversion tracking (client-side + server-side Measurement Protocol) | IP address (truncated/anonymised), Page views and events, Pseudonymous client identifier, Conversion metadata (plan, country, MRR) | United States | SCC + EU-U.S. DPF | policies.google.com |
| ZeroBounce LLC | Email validation (deliverability checks of lead and user email addresses) | Email address | United States | SCC | www.zerobounce.net |
| Loops, Inc. | Marketing & lifecycle email (onboarding sequences and campaigns) | Email address, Name, Product event metadata | United States | SCC | loops.so |
| Qik Innovations Pvt Ltd (OpenSign) | Electronic signature platform for B2B contracts, NDAs and one-shot business documents (ad-hoc use) | Signer name and email, IP address and user agent at signature, Signature image / drawn signature, Timestamp and audit trail, Document content (may contain personal data depending on the signed document) | India (hosted SaaS at opensignlabs.com; EU instance at eu-app.opensignlabs.com — residency not contractually guaranteed) | SCC (pending signature) | www.opensignlabs.com |
Próximos subcontratantes
Os fornecedores abaixo foram notificados aos clientes e só passam a tratar dados pessoais a partir da data indicada. Até essa data não fazem parte da lista acima.
| Nome | Em vigor a partir de | Função | Categorias de dados | Localização | Base de transferência | Política do fornecedor |
|---|---|---|---|---|---|---|
| Groq LLC | 25 de outubro de 2026 | Speech-to-text transcription of voice notes (server-side dictation) | Voice recordings of users who use server-side dictation, Resulting transcript text | United States | SCC | console.groq.com |
Para questões, contactar privacy@cepaos.com