Subprocessors
The providers observed in the running stack, not a contracted register.
This list is compiled by reading the application’s own configuration. It is accurate about what the code reaches; it is not yet a verified vendor register with signed terms and international-transfer bases, and that difference matters.
Updated 31 August 2026
Draft status. A review draft: not indexed, and not final until checked by qualified counsel.
01
Which providers does the application use?
- Clerk — authentication, account identity and sessions.
- Vercel — application hosting, and the AI Gateway through which every model call is routed.
- The managed PostgreSQL provider — the corpus, workspaces, campaigns and audit records.
- Resend and Amazon SES with SNS — campaign delivery and the bounce, complaint and delivery events that come back from it.
- NeverBounce — email-address verification, when an operator spends credits on it.
- DeepSeek, reached through the Vercel AI Gateway — the model behind the planner and the drafting features. See AI transparency for what it is and is not given.
02
What is not on this list, and why?
Wikidata and the public media directories the corpus is built from. They are sources read by offline scripts, not processors acting on instructions — nothing is sent to them.
There is also no analytics provider, no advertising network and no session-replay tool, which is why the cookie policy is as short as it is.
03
What makes this a draft?
A real subprocessor list states, for each entry, the contracting entity, the purpose, the data categories, the hosting region and the transfer mechanism, and it comes with a change-notification subscription. None of that is settled here — several of these providers process outside the EU, and the transfer bases have not been documented.
04
How will changes be announced?
Through this page and the changelog, which has an RSS feed. A dedicated subscribe-to-changes mechanism is part of the vendor register work that has not been done.