Trust · Subprocessors
Publish what each provider does—and what is not yet confirmed.
This list shows current design and review status. An effective list will match actual contracts, regions, and retention periods.
| Provider | Work | Scope | Status |
|---|---|---|---|
| Supabase | Authentication, database, private files | Product workspace | Contract and project region require final confirmation |
| NICEPAY | Payment authorization and refunds | Korea payments | Merchant, terms, and privacy flow to be confirmed before live payments |
| Sites / Cloudflare | Public-site delivery | Public Web | No customer-workspace content |
| Email provider | Security, invitation, billing, and support notices | Not active | Provider, region, and retention to be published after selection |
| AI provider | Allowed candidate generation | Not active | No customer-data transmission before no-training, retention, DPA, and field gates pass |
Material changes will not be silent.
A new provider or processing region that affects customer data will follow the contracted notice and objection process.
Review the DPA draft →