Subprocessors
Last updated August 5, 2026
These are the third parties that process customer data on our behalf. Each acts only on our documented instructions. This page is the authoritative list; section 7.1 of the Privacy Policy mirrors it.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Supabase, Inc. | Authentication, application database, file storage | United States | Account data, uploaded documents, valuations |
| Cloudflare, Inc. | Hosting, CDN, DDoS and bot mitigation | United States, global edge | IP address, request metadata |
| Stripe, Inc. | Payment processing, billing, fraud prevention | United States | Billing details, payment metadata |
| Resend, Inc. | Transactional and inbound email | United States | Email address, message content |
| OpenAI, L.L.C. | Text embeddings for comparable-company matching (API tier, no training on customer data) | United States | Company descriptors |
| Google LLC (Cloud / Gemini API) | Language-model processing (API tier, no training on customer data) | United States | Document text submitted for extraction |
| Firecrawl | Public-web ingestion for benchmark datasets | United States | No customer-submitted content |
| PostHog, Inc. | Product analytics and error monitoring | United States | Usage events, error reports |
| rejestr.io | Polish KRS company data lookup | Poland (EU) | Company identifiers you search for |
| Google LLC (Ads), LinkedIn Corporation | Marketing attribution on the public website only, loaded solely with consent | United States | Advertising identifiers, IP address |
Transfers out of the EEA and the UK
Most of the providers above are in the United States. Where personal data of an EEA or UK individual reaches them, the transfer relies on the European Commission’s Standard Contractual Clauses (with the UK Addendum where the UK GDPR applies), together with the provider’s own technical and organisational measures. We will provide the specific safeguards used for a given transfer on request.
Changes to this list
We update this page before a new subprocessor begins processing customer data. If you are a Team or Pro customer and want advance notice of additions, email [email protected] and we will add you to the notification list. You may object to a new subprocessor on reasonable data-protection grounds, and if we cannot resolve the objection you may terminate the affected part of your subscription.
Data processing agreement
If you upload personal data belonging to other people (for example the financial records of a company you are valuing), you are the controller and we are your processor. Our Data Processing Agreement covers that relationship.