Subprocessors
Last updated 2026-08-25
To deliver the FirmCert service we use the following third-party vendors ("subprocessors"). Each is engaged under a contract that limits their use of your data to providing their specific function. This list reflects what is active in production today; we will update this page when subprocessors are added or removed.
| Subprocessor | Function | Data received | Location |
|---|---|---|---|
| Stripe | Payment processing | Card details (entered directly into Stripe), billing ZIP, charge metadata | United States |
| Supabase | Database, authentication, file metadata | Encrypted account data, order records, audit logs | AWS US-East |
| Cloudflare R2 | File storage | Uploaded documents and translated outputs (encrypted at rest) | Global Cloudflare edge |
| Document and data processing | Document content and processing instructions | United States | |
| Anthropic | Document and data processing | Document content and processing instructions | United States |
| VirusTotal | Malware scanning of uploads | Uploaded file bytes | United States (Google subsidiary) |
| Resend | Transactional email delivery | Email address, message contents | United States |
| Inngest | Background job processing (translation pipelines, scans, retries) | Job payloads referencing order and document IDs | United States |
| Upstash | Redis caching, rate limiting, idempotency keys | IP addresses, request fingerprints, transient cache entries | AWS US-East |
| Sentry | Error monitoring | Error stack traces, request URLs (with sensitive query parameters stripped) | United States |
| PostHog | Product analytics | Page views, feature usage events | United States |
Changes
We will update this list when we add or remove subprocessors. Material changes that expand the scope of what subprocessors receive will be reflected in the Privacy Policy "Last updated" date.