Sub-processors
Version 2026-10-16 · Effective October 16, 2026
1. Our Sub-processors
To deliver Conduct Studio we use the service providers listed below. A provider is described as a sub-processor only for processing it performs on customer instructions. The list reflects providers configured or designated for the current service; a provider's exact role depends on the features a customer uses. Before paid checkout is enabled, the operator register requires confirmation of the applicable contract and transfer evidence for every production account.
2. Current List
The table states each provider's function, expected processing region, and published DPA location. Where a transfer leaves the EU/EEA or UK, the applicable mechanism must be confirmed in the current vendor record. We use Data Privacy Framework language only for a recipient whose current certification has been checked.
| Processor | Purpose | Location | DPA |
|---|---|---|---|
| Supabase Inc. | Authentication, database, file storage, and realtime | EU project region; provider support operations may be global | supabase.com/legal/dpa |
| Vercel Inc. | Application hosting, web portal, serverless functions, and cron | EU execution preference; provider operations may be global | vercel.com/legal/dpa |
| Stripe, Inc. / Stripe Payments Europe | Payment processing, billing, fraud prevention, and tax calculation | EU and global payment network | stripe.com/legal/dpa |
| Brevo SAS | Transactional email delivery | EU (France) | brevo.com/legal/dpa |
| PostHog Inc. | Product analytics (account ID, organisation ID, feature-usage events) — only with consent | EU (eu.posthog.com) | posthog.com/dpa |
| Functional Software, Inc. (Sentry) | Error monitoring, desktop-app crash reports, and performance tracing with application-side redaction | Provider infrastructure and support may be global | sentry.io/legal/dpa |
| Cloudflare, Inc. | Encrypted off-site backups in R2, and Turnstile bot protection on the sign-in, sign-up and password-reset forms (see the Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy) | Provider infrastructure and support may be global | cloudflare.com/cloudflare-customer-dpa |
3. Changes & Notifications
We review our sub-processors at least annually and update this page when they change. We provide advance notice before authorising any new sub-processor to process customer personal data. To receive these notifications, email privacy@conductstudio.com with the subject "Subscribe to sub-processor updates". Customers may object to a new sub-processor on reasonable data-protection grounds as described in the Data Processing Addendum.