Subprocessors
Leer en españolThe providers that touch CRM data, what for, what they receive and where they store it.
Version 1.1 · effective 2026-09-06 · Available in English and Spanish. In case of discrepancy, the English version prevails.
Who processes data on our behalf
This list is part of the Data Processing Agreement. Any change is notified to organization owners 15 days in advance. There are no other third parties: we use no analytics, advertising or tracking tools.
| Provider | What for | What data it receives | When | Where |
|---|---|---|---|---|
| Supabase | Database, authentication and file storage | All CRM data (column-level encryption for SSNs and bank details) | Always | European Union (Ireland, AWS eu-west-1) |
| Vercel | Hosting and running the application | Data passes through its servers to serve each request; nothing is stored there | Always | United States and global delivery network |
| Resend | Email delivery (service notices, agency campaigns and payment reminders) | Address, subject and body of each email sent | When sending email that does not go out through the agent's Gmail | United States |
| Sign in with Google, and the agent's Gmail and Google Calendar | Account identity; the emails the agent sends from the CRM and their appointments. We do not read their mailbox. | Only if the agent connects it; disconnects with one click | United States | |
| Anthropic | The Copilot (AI assistant) | Summaries with no sensitive data: never SSNs, bank details, medical conditions or email bodies | Only when a question is asked to the Copilot, and only if the platform has the integration enabled | United States |
Providers that process in the United States do so under the safeguards the GDPR requires for transfers from the European Union (standard contractual clauses or the EU-US Data Privacy Framework, as applicable to each).
Payment gateway: none is integrated yet; billing is handled directly. Before enabling one (foreseeably Stripe) it will be added to this list with prior notice.
When an agency connects its own email domain, its own Gmail, or asks for a custom integration, that agency's provider is not our subprocessor: the agency chooses and contracts it.