Subprocessors

Last updated: 2026-05-30

Socianote uses the following third-party vendors ("subprocessors") to deliver the service. Under GDPR Article 28(2), customer organisations (controllers) have the right to be informed of subprocessor changes and to object. To receive change notifications, email [email protected].

Supabase

Purpose:: Database, authentication, file storage, realtime
Data location:: Singapore (ap-southeast-1) — primary; EU regions available on request for enterprise customers

Vercel

Purpose:: Application hosting, edge runtime, CDN
Data location:: Global edge network; static + edge functions only — no PII at rest

Resend

Purpose:: Transactional email (invites, password resets, notifications)
Data location:: United States; minimal data (recipient email + subject only)

Cloudflare

Purpose:: DNS, CDN, DDoS protection — routes traffic; IP address metadata only
Data location:: Global edge network; no Customer Data persisted (request metadata retained <7 days)

Vercel Speed Insights

Purpose:: Page performance analytics (load times, Core Web Vitals) — URL path and timing metadata only, no participant data payload
Data location:: United States; URL path metadata only (e.g. /dashboard/cases/[uuid])

Sentry

Purpose:: Error tracking and crash reporting — stack traces and request paths; PII scrubbed from error payloads where possible
Data location:: United States

Don't see a vendor you expected?

Socianote does not currently use any other subprocessors for personal data processing. We do not share your data with advertising networks, analytics providers, or AI training datasets. If you need a written confirmation, contact [email protected].