Sub-processors
Last updated: 27 July 2026
WebsiteOS uses the third-party providers below to help deliver the service. Each processes personal data on our behalf under a data processing agreement, and each transfer of data outside the EEA is covered by the safeguard shown.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Database, authentication, storage | EU (Frankfurt, eu-central-1) at rest; US company | Standard Contractual Clauses + supplementary measures |
| Stripe, Inc. | Payments and subscription billing | US (and global) | EU-US Data Privacy Framework; SCCs as fallback |
| Resend (Plotia, Inc.) | Transactional email delivery | US | EU-US Data Privacy Framework |
| Vercel Inc. | Application hosting, edge/CDN | US (and global edge) | EU-US Data Privacy Framework |
| Cloudflare, Inc. | DNS, CDN, edge compute, security | US (and global edge) | EU-US Data Privacy Framework; SCCs as fallback |
| Google LLC | Analytics (GA4) and tag management (GTM) | US (and global) | EU-US Data Privacy Framework |
| Anthropic PBC | AI content generation | US | Standard Contractual Clauses |
We use general written authorization for sub-processors. We will notify customers at least 30 days before adding or replacing a sub-processor, giving you the opportunity to object. To object, or to subscribe to change notifications, email hello@websiteos.ai.
We keep each provider's data processing agreement, and where applicable a transfer impact assessment, on file and provide them on request.