Sub-processor Disclosure: Listing Every Third Party

The full executive answer

Here is the complete sub-processor list, the same one that appears in our Data Processing Agreement — ten names, each with a purpose: Vercel (application hosting and delivery), Supabase (the Postgres database and file storage, running on AWS in Tokyo), Clerk (identity and sign-in), Anthropic and OpenAI (the two AI model providers — sent only sanitised, PII-redacted inputs, with no training on your data under our API terms), Lemon Squeezy and Stripe (payments — card data never touches our systems; it goes directly to them as PCI-certified processors), Resend (transactional email), Sentry (error monitoring, with data scrubbing configured), and PostHog (product analytics). That's the whole list. No shadow analytics, no data brokers, no offshore support tooling with database access.

How we manage them: every one is a major, security-certified provider — the deliberate strategy is to inherit certified infrastructure (Supabase's AES-256 encryption at rest, Vercel's SOC 2, Stripe's PCI-DSS Level 1) rather than build uncertifiable custom plumbing. Our ISO Statement of Applicability explicitly marks controls satisfied by sub-processors as "inherited," so the dependency is documented, not hidden. Data minimisation applies per processor: the AI providers get redacted text, not your database; the analytics layer gets usage events, not board content; the email provider gets addresses and notifications, not documents.

What the honest version includes: our formal vendor-review cadence — annually re-verifying each sub-processor's certifications and DPA terms on a schedule — is being formalised as part of SOC 2 readiness this year; today it's point-in-time diligence rather than a calendared programme. Contractually, our DPA includes the sub-processor list with a notice-and-objection mechanism for changes, which is the Article 28 standard your team will expect.