Legal
Sub-processors
These are the third parties that may process personal data on our behalf to provide SourceFinch. Each is bound by a written agreement that limits its use of the data to providing services to us and requires appropriate security. This list is part of the Data Processing Addendum, and the Privacy Policy refers to it.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage and edge functions | Account, workspace, billing-status and customer content; authentication records | United States (AWS us-east-1) |
| Vercel Inc. | Web application hosting and content delivery | Request metadata (IP address, user agent) and pages served | United States, with global edge delivery |
| Fly.io, Inc. | Acquisition workers that fetch the Sources you configure | Source configurations and content fetched for you | United States (Ashburn, Virginia) |
| Stripe, Inc. | Payments, subscriptions, invoices and the billing portal | Billing contact, payment method (held by Stripe), subscription status | United States |
| Resend (Plus Five Five, Inc.) | Transactional and authentication email | Recipient email address and message content | United States |
| PostHog, Inc. | Privacy-preserving product analytics (no cookies; page path and product events only) | Session-scoped random identifier, page path, product milestone events | United States |
| Google LLC | Optional sign-in with Google Only if you choose to sign in with Google. | Name, email address and Google account identifier | United States |
| Microsoft Corporation | Optional sign-in with Microsoft Only when “Continue with Microsoft” is offered and you choose it. | Name, email address and Microsoft account identifier | United States |
| Cloudflare, Inc. | Turnstile bot protection on sign-up, sign-in and request forms Only when bot protection is enabled on those forms. | Browser and device signals evaluated for the challenge | United States and global network |
Changes
We add a provider to this list before it begins processing personal data. Customers on a Data Processing Addendum who want advance notice of changes can subscribe by writing to privacy@sourcefinch.com; they may object on reasonable data-protection grounds as the addendum describes.