Subprocessors

The providers that process data on behalf of GRATOX so the platform can run. Each does one specific job and sees only what that job requires.

Version in force since 2026-08-21. Client companies are given 30 days' notice before a new one is added.

There is a current data processing agreement with all of them, either signed or incorporated into their terms of service.

Supabase

United States (Oregon)

Database, user accounts and part of the file storage.

All platform data: accounts, projects, reports and audit records.

Render

United States (Oregon)

The servers running the application and its background processes.

Data passes through here while being processed. It is not stored permanently.

Vercel

Global delivery network

Serving the web interface and measuring site visits.

Browsing data. Visit measurement is aggregated and does not identify anyone.

Cloudflare R2

Global delivery network

File storage: site photographs and project documents.

The files users upload, including photographs that may show people.

Upstash

United States (Ohio)

Job queue: imports and exports that run in the background.

References to pending jobs. In transit and short-lived.

Resend

United States

Sending platform email: notices, invitations and access codes.

Email addresses and the content of those notices.

Anthropic

United States

The artificial intelligence assistant in the Scheduling module.

What the assistant is asked about the project.

Only if the company enables the module, using its own Anthropic key. GRATOX has no shared key: if the company does not provide one, nothing is sent to this provider.

Questions about any of these providers, or want to be notified of changes? Write to contacto@gratox.net.

Changes to this list

2026-08-21 · First publication of the list.