Subprocessors
Version 1.0 · 9 September 2026
Dutch version prevails in case of conflict.
Annex to the Data Processing Agreement.
| Vendor | Role | Data | Region |
|---|---|---|---|
| Supabase | Database, auth, files, API | All app data | EU — AWS eu-west-1 (Ireland) |
| AWS (via Supabase) | Hosting under Supabase | Same data | eu-west-1 |
| Vercel | Website + web app | Request/visitor data | Global edge |
| Resend | Transactional email | Email address + content | US (default) |
| Google (FCM) | Push notifications | Push token + notification text | Global |
| Plausible | Site analytics (if on) | Pageviews (cookieless) | EU |
| PostHog | Product analytics (if on) | App events | EU cloud (eu.i.posthog.com) |
Short version: chats and documents live in the EU. Email (Resend) and push (Google) may leave the EU.
Vendor DPAs: on their sites (Supabase, Vercel, Resend, Google Cloud, PostHog, Plausible).