Subprocessors
Providers used to operate RemedyProof
Effective date: September 4, 2026
This page lists the core providers currently configured for RemedyProof and optional providers only where a deployment explicitly enables them. Google and Meta are optional advertising or analytics services that require the relevant consent. OpenAI is conditional on AI Defensive Brief configuration. Providers not configured for this deployment are omitted from processing.
| Provider | Role | Data categories | Transfer / notice |
|---|---|---|---|
| Supabase | Database, authentication, and application storage infrastructure | Account, workspace, property, finding, evidence, and authorization records | See Supabase privacy notice and applicable transfer safeguards |
| Vercel | Web application hosting and delivery | Request metadata and application data needed to serve the control plane | See Vercel privacy notice and applicable transfer safeguards |
| Stripe | Payment processing and subscription billing | Billing identity, subscription references, invoices, and payment status; Stripe handles card details | Stripe may act as an independent controller for payment data; see Stripe privacy notice |
| Optional website analytics and advertising measurement after consent | Consent status, online identifiers, campaign and conversion data | Google may act as an independent controller for its services; see Google privacy notice | |
| Meta | Optional advertising measurement after consent | Consent status, online identifiers, campaign and conversion data | Meta may act as an independent controller for its services; see Meta privacy notice |
| OpenAI (when AI Defensive Brief is enabled) | On-demand AI-assisted explanation of one authorized actionable finding | Normalized rule, state, severity, proof/error class, authorized canonical hostname, last-observed time, reviewed remediation fields, source keys, and a hashed or pseudonymous user identifier where applicable; direct account identity or contact data, raw page content, response bodies, credentials, secrets, private notes, and event reasons are excluded | See OpenAI privacy notice and applicable transfer safeguards |
Changes to this list
We may add or replace a provider when the service changes. We will update this page and, where required, provide notice or an opportunity to object before the change takes effect.
Questions and contact
Questions about subprocessors can be sent to support@remedyproof.com.