Subprocessor List
Version 2026.09.20 | Effective September 20, 2026
Source package: Customer-Facing Legal Policies
This list identifies material third-party providers that may process Customer Personal Data to provide TacSafe. Actual processing depends on the enabled features and production configuration.
| Provider | Purpose | Data involved | Notes |
|---|---|---|---|
| Vercel | Web application hosting and delivery | Application requests, diagnostics, deployment/runtime metadata | — |
| Supabase | Database, authentication, managed backend services | Account data, workspace records, authentication metadata | Production tenant/data store. |
| Cloudflare R2 | Private object storage | Uploaded files, documents, images, generated files | Private bucket/access-controlled delivery. |
| Stripe | Subscription billing and payment processing | Billing contact and transaction metadata; payment-card data handled by Stripe | When Customer purchases a paid subscription. |
| Postmark | Transactional email delivery | Recipient email, template content, delivery metadata | When TacSafe sends transactional email on Customer's behalf. |
| OpenAI | AI-assisted processing for enabled features | Only content necessary for the requested AI feature | — |
Subprocessor changes. Where required by the applicable DPA, TacSafe will provide notice of a new material subprocessor and a reasonable opportunity to raise a data-protection objection.