Sub-processors
The third-party services PolicifyAI uses to operate its platform. All sub-processors are bound by contractual data-processing terms and appropriate transfer mechanisms.
Last updated: 28 July 2026
| Sub-processor | Purpose | Data types | Location |
|---|---|---|---|
| Supabase ↗ | Database, authentication, and storage | Account data, generated policies, authentication identifiers | EU (Frankfurt) |
| Vercel ↗ | Web hosting and edge compute | Request metadata, IP addresses, user-agent strings | Global edge; primary compute regions: EU & US |
| Stripe ↗ | Payment processing and subscription billing | Billing name, email, card details (tokenised), transaction history | EU / US |
| OpenRouter ↗ | AI request router for policy generation and quality scoring - our direct AI sub-processor. Routes each request to an underlying model provider (primarily Anthropic and Google, occasionally others OpenRouter supports) depending on the task and availability | Prompt inputs during generation and scoring (business name, industry, jurisdiction, generated policy text) | US |
| Anthropic ↗ | Underlying AI model provider - receives requests as OpenRouter's sub-processor, not directly from PolicifyAI | Prompt inputs during generation (business name, industry, jurisdiction) | US |
| Google ↗ | Underlying AI model provider (Gemini) - receives requests as OpenRouter's sub-processor, not directly from PolicifyAI | Prompt inputs during generation (business name, industry, jurisdiction) | US |
| Resend ↗ | Transactional email delivery | Email address, email content (receipts, confirmations, notifications) | EU / US |
| Google Analytics ↗ | Aggregated website usage analytics (GA4) | Anonymised page views, events, session data (IP anonymised) | US (Google LLC) |
| PostHog ↗ | Product analytics and feature tracking | Anonymised product usage events, feature interactions | EU (Frankfurt) |
International transfers
Where sub-processors operate outside the UK or EEA, transfers are governed by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, as applicable.
Notice of changes
We update this list when sub-processors change. Material changes will be announced to customers at least 30 days in advance where contractually required.
Questions
For DPA requests or questions about sub-processors, email [email protected].