Sub-processor register
Every third party that may process customer data, what they do, and where.
Last updated 7 vendors in 6 entriesJSON
Sub-processors
| Vendor and purpose | Data | Region | DPA | Listed since |
|---|---|---|---|---|
| SupabaseDatabase, authentication, file storage | Account & application data | EU (AWS eu-west-1) | Yes | |
| CloudflareCDN, edge compute, DNS, WAF | Request metadata in transit | Global edge (EU-served) | Yes | |
| StripePayment processing | Billing details (card data not stored by us) | EU / US (DPF, SCCs) | Yes | |
| ResendTransactional & lifecycle email | Name, email, message content | EU / US (SCCs) | Yes | |
| AI model providers (Anthropic, Google)Club AI features (matching, assistant) | Prompts — never used to train models | EU / US (SCCs) | Yes | |
| PostHogProduct analytics — consent-gated, off by default | Anonymised usage events | EU | Yes |
Data residency & data flow
Where data lives, and how it moves
Where your data is stored and processed, and how cross-border transfers are governed.
- Primary region
- Primary storage and processing of core customer data in the European Union (AWS eu-west-1, via Supabase).
- Relocation
- No setting relocates core customer data outside the EU.
- Transfers
- Cross-border transfers to sub-processors governed by SCCs (and the EU–US DPF where applicable).
- AI model providers
- The model providers behind Club AI (Anthropic, Google) are named in our sub-processor table with region and data terms, and each is bound by a DPA with SCCs. Prompts are processed under contract and never used to train or fine-tune their models. We list them so you always know which third parties touch AI-related data.
- Authoritative list
- The authoritative transfer list is the sub-processor table above and our Data Processing Agreement.
Change log
Changes to this list
Additions to and removals from this list, with their dates.
No recorded changes since the list was published in June 2026.
6 entries unchanged