| Subprocessor | Purpose | Data handled | Region |
|---|---|---|---|
| Vercel | Application hosting / CDN | Request metadata, app traffic | US |
| Supabase (on AWS) | Database, storage, auth | Account, vendor, COI PDFs, audit events | US |
| OpenRouter → Anthropic | COI extraction (Claude vision) | Uploaded COI PDFs at extraction time | US |
| Resend | Outbound email (chase, reports) | Recipient email, message content | US |
| Postmark | Inbound email intake (email-in) | Forwarded COI emails + attachments | US |
| Twilio | SMS chasing (opt-in only) | Vendor phone, message content | US |
| Paddle | Billing (merchant of record) | Billing contact, subscription data | US / EU |
| Documenso | Agreement e-sign | Agreement documents, signer email | US |
| Sentry | Error / performance monitoring (when enabled) | Error metadata, request context | US |
Data Processing Agreement
A Data Processing Agreement (DPA) is available on request for customers who need one. Email shivanshu814pathak@gmail.com and we will send the current DPA for signature. Material changes to this subprocessor list are reflected here.
Document review assistance — not legal, insurance, or professional advice.