A subprocessor is a third party that processes data on our behalf so we can operate the service. The list below is the current, verified set of providers we use. We share the minimum necessary information with each, and each provider processes it only to deliver its part of the service.
Core platform — providers that run the product itself and handle application data. These are critical to the service.
Marketing / lead generation — providers used solely by our lead-capture funnel (the /plumbing pages), separate from the client application. They do not process core audit-platform data — no client documents, audit findings, or engagement records ever flow to them.
Other — serves our webfont only.
Current subprocessors
| Provider | Purpose | Data type | Class | Processing location |
|---|---|---|---|---|
| Core platform | ||||
| Supabase | Postgres database, authentication, file storage, edge functions | All application data | Critical · Core platform | United States (us-east-1) |
| Vercel | Website and serverless hosting | HTTP requests; funnel API payloads | Critical · Core platform | Provider-dependent; see provider documentation. |
| Anthropic | AI model provider (Claude Haiku 4.5) for AI-assisted features | Minimized engagement metadata (e.g. file names, statuses) | Critical · Core platform | Provider-dependent; see provider documentation. |
| Marketing / lead generation | ||||
| Meta (Facebook) | Meta Pixel and Conversions API — ad measurement | Hashed contact data and technical identifiers | Marketing · Funnel only | Provider-dependent; see provider documentation. |
| Typeform | Funnel lead form | Lead form responses | Marketing · Funnel only | Provider-dependent; see provider documentation. |
| Calendly | Funnel call scheduling | Name, email, and chosen time on booking | Marketing · Funnel only | Provider-dependent; see provider documentation. |
| Other | ||||
| Google Fonts | Serves the Inter webfont | Visitor IP address (no cookie set) | CDN | Provider-dependent; see provider documentation. |
Scroll horizontally to see every column on smaller screens.
Keeping this list current
This list was last updated 25 September 2026. We will update it as our providers change — when one is added, removed, or replaced. Core application data is hosted with Supabase in the United States (AWS us-east-1); other processing locations are provider-dependent, and we state a specific region only where we have confirmed it.
Questions about our subprocessors
Contact edward@alpha-scaling.com.