← Legal
Sub-processors
Last updated 13 September 2026
The list of sub-processors referred to in section 10 of the DPA and its Annex III.
Supabase
- Legal entity
- Supabase Pte. Ltd
- Purpose
- Database, authentication and backend infrastructure
- Data categories
- All Customer Personal Data
- Processing location
- Per Supabase DPA clause 6.1 (Location): Supabase "may Process Covered Data anywhere that Supabase or its Sub-processors maintain facilities", with a specific region only "where Customer directs Supabase to Process Covered Data in a specific geographical region". Schedule 1 describes a "follow-the-sun model" staffed by "employees strategically placed around the world".
- Transfer mechanism
- Standard Contractual Clauses, where processing or support access occurs outside the EEA.
- Provider’s data processing agreement
- https://supabase.com/legal/customer-resources/data-processing-addendum
Amazon Web Services
- Legal entity
- Amazon Web Services, Inc
- Purpose
- Infrastructure underlying Supabase; named as its cloud provider
- Data categories
- All Customer Personal Data
- Processing location
- Not stated in any agreement Assembley executed. AWS is engaged by SUPABASE, so the governing terms are between those two — per Supabase DPA clause 6.2, Supabase's authorised sub-processors are those on its published list, and Supabase "shall … enter into a written agreement with each Authorized Sub-processor imposing data protection obligations that, in substance, are no less protective" than its own.
- Transfer mechanism
- Inherited from Supabase's agreement with AWS; not one Assembley is party to.
- Provider’s data processing agreement
- https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
Vercel
- Legal entity
- Vercel Inc., a Delaware corporation
- Purpose
- Application hosting, serverless functions and edge delivery
- Data categories
- All Customer Personal Data passing through the application
- Processing location
- Per Vercel DPA clause 13(a) (International Provisions — Processing in the United States): "Customer acknowledges that, as of the Effective Date, Vercel's primary processing facilities are in the United States", and Vercel "may … need to transfer and process Customer Data to and in the United States and anywhere else in the world where Vercel or its Subprocessors maintain data processing operations".
- Transfer mechanism
- Per Vercel DPA Schedule 3 (Cross Border Data Transfer).
- Provider’s data processing agreement
- https://vercel.com/legal/dpa
Resend
- Legal entity
- Plus Five Five, Inc. (trading as Resend)
- Purpose
- Transactional email delivery — invitations, voting links, verification codes
- Data categories
- Participant name, Participant email address, Message content
- Processing location
- Per Resend DPA clause 6.1 (Transfers of Personal Data): "Customer acknowledges that Company's primary processing operations take place in the United States, and that the transfer of Customer's Personal Data to the United States is necessary for the provision of the Services to Customer."
- Transfer mechanism
- EU Standard Contractual Clauses, per Resend DPA clause 6.2.
- Provider’s data processing agreement
- https://resend.com/legal/dpa