A subprocessor is a third party that stores or processes participant data on our behalf. This list is current as of 27 October 2026. We update it before adding a new subprocessor and keep a dated change log at the bottom.
| Provider | Service | What they process | Region | Compliance |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless functions, CDN | All application traffic, including participant data in transit through the application layer; request logs | Functions: Sydney, Australia (syd1). CDN: global, static assets only | SOC 2 Type II, ISO 27001. security.vercel.com |
| Supabase Inc. | PostgreSQL database, authentication, backups | All stored participant data; email addresses for one-time code delivery; backups | Sydney, Australia (AWS ap-southeast-2) | SOC 2 Type II, HIPAA (available). supabase.com/security |
| GitHub Inc. (Microsoft) | Source code hosting, CI | Source code only. No participant data | United States | SOC 2 Type II, ISO 27001. github.com/security |
| Anthropic PBC | Claude API, used to write the narrative text in reports | Assessment scores and factor labels. No names, email addresses, or organization names | United States (no regional inference option is set) | SOC 2 Type II, ISO 27001, ISO 42001. No training on API data; inputs deleted within 30 days. trust.anthropic.com |
| Twilio Inc. (SendGrid) | Transactional email: the sign-in email, sent through Supabase Auth | Email address and the one-time sign-in code | United States | SOC 2 Type II, ISO 27001. twilio.com/trust-center |
Infrastructure beneath the subprocessors
Supabase runs on Amazon Web Services (ap-southeast-2). Vercel runs on AWS for serverless functions. Both providers' compliance documentation covers their use of AWS.
What we don't use
No advertising networks, no data brokers, no session-recording tools, no error-tracking service, no third-party cookies, and no analytics on the app. The public site flame.live uses Vercel Web Analytics (cookieless page counts, no personal data), covered by the Vercel entry above.
Change log
- 27 October 2026: Initial publication. Vercel function region moved from Washington, D.C. (us-east-1) to Sydney (syd1).