Subprocessors
Last updated June 15, 2026
The third parties we use to operate our website and commercial services - and why self-hosted deployments keep your governed data out of all of them.
Overview
A subprocessor is a third party we engage to process personal data in the course of operating our business. We use a small, vetted set, bind each to data protection obligations, and keep this page current.
Self-hosted deployments
This is the important part: when you run DataStrict in your own environment, the traffic it governs is processed inside your own environment and is not shared with any subprocessor below. The list relates to our website and commercial operations - our marketing site, contact forms, and analytics - not to your governed data.
Current subprocessors
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel, Inc. | Website hosting and content delivery | United States |
| Supabase, Inc. | Authentication and application database | United States / EU |
| Resend | Transactional email (contact and support forms) | United States |
| Google LLC | Product analytics, loaded only after consent | United States |
| Anthropic, PBC | Optional LLM-judge for ambiguous policy decisions, only when you enable it | United States |
Changes and contact
We will update this page before adding or replacing a subprocessor that processes personal data, so you have time to review. To receive notice of changes or to raise a concern, email [email protected].
Questions about this policy? Email [email protected].