DRAFT: revised 15 September 2026, not a completed vendor review. CRM data is processed by database/application hosting and can appear in encrypted backups. AI providers process simulated training separately. A UK adequacy decision for a hosting country does not establish where every support or onward processing operation occurs.
Legal
Subprocessors
This draft records vendors and processing requiring due diligence. No signed customer DPA, completed transfer assessment or blanket vendor processor status is asserted. Confirm contractual entities, enabled services, subprocessors, support access, retention and the appropriate transfer mechanism for each vendor. Notification and objection terms must be agreed in the final processing agreement.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Amazon Web Services | Restricted encrypted offsite database backups | Encrypted database archives including CRM records; no plaintext recovery key | Configured backup bucket: Stockholm, Sweden. Support/access locations and contract evidence require review. |
| Supabase Inc. | Authentication, Postgres database hosting | Email, name, session transcripts, scores, billing IDs and CRM lead/contact data, notes, activities and reminders | Location/contract evidence required before launch |
| Anthropic PBC | LLM inference (persona, scoring, analysis, safety) | Simulated training transcripts and generated outputs; no CRM API calls. Provider retention and training-use terms require evidence | US processing indicated; agreement, exact locations, retention and transfer mechanism unverified |
| Stripe Payments Europe Ltd. | Subscription billing, card processing | Email, billing address, payment method (tokenised), invoice history | Contracting entity, processing/support countries and transfer mechanism unverified |
| Vercel Inc. | Application hosting, edge + serverless compute, log delivery | Application request processing, including CRM data; operational metadata such as IP address, user agent and timings | Staging builds report iad1 (US); edge, runtime and support locations require project-by-project verification |
| Upstash, Inc. | Redis rate limits/replay protection; QStash scheduling | Rate-limit identifiers can include email addresses, user IDs and IP addresses; replay nonces, counters, heartbeat timestamps. QStash receives destinations and authentication headers; logs redact Authorization | Location/contract evidence required before launch |
| Resend Inc. | Transactional email delivery (magic links, receipts) | Recipient email and rendered message body/sign-in links; provider storage and deletion require contractual verification. Internal app queue separately stores references/metadata | US processing indicated; agreement, exact locations, retention and transfer mechanism unverified |
| Sentry (Functional Software, Inc.) | Server + client error tracking | Stack traces, request metadata, user ID (no message content) | US processing indicated; agreement, exact locations, retention and transfer mechanism unverified |
| PostHog Inc. | Product analytics (page views, feature usage) | Pseudonymous user ID, event properties (no message content) | Location/contract evidence required before launch |
| Axiom Co. | Structured server log storage | Request paths, response timings, user IDs | US processing indicated; agreement, exact locations, retention and transfer mechanism unverified |
Draft last revised: 15 September 2026. A customer processing agreement is being drafted and is not yet executed. For questions, contact bridgethegaphq@gmail.com.