Subprocessors and Service Providers

Effective: October 12, 2026

1. DPA subprocessors and service providers

Not every provider receives every category. A provider processes Customer Personal Data only when the relevant feature or data flow is used.

Provider	Purpose	Typical data	Typical processing location
Vercel Inc.	Application hosting, serverless functions, scheduled jobs, edge delivery and CDN	Customer Content, requests, IP addresses, headers, traffic and runtime logs	United States (functions run in the US East region) and Vercel's global edge network
Cloudflare, Inc.	Authoritative DNS for accountmade.com (not used to host the application)	Domain name lookups and DNS query metadata	Global network
Supabase Inc.	Database, authentication, object storage	Account Data, Customer Content, workspace and integration data	United States (AWS us-east-1)
Upstash, Inc.	Cache, queues, rate limits, temporary job state	Pseudonymous identifiers, counters, transient operational data	United States or configured region
Resend, Inc.	Transactional email	Names, email addresses, message and delivery metadata	United States
PostHog, Inc.	Usage analytics and error diagnostics where enabled	Pseudonymous usage and feature events, browser/device data, sanitized exception types and static code locations	United States
Anthropic, PBC	Commercial API AI generation, extraction, and evaluation (Claude Haiku)	Prompts, selected source content, business context, generated output	United States
OpenAI, L.L.C.	Commercial API embeddings (semantic search), image tagging of uploaded workspace assets, and backup AI generation when Anthropic is unavailable	Text selected for embedding, uploaded image content and metadata, resulting vectors and tags; for backup generation, the same prompt and Customer Content sent to Anthropic	United States

AI providers are used through commercial accounts with no-training restrictions. AccountMade disables provider storage where supported and limits ordinary provider abuse-monitoring retention to 30 days unless a verified zero-retention setting applies.

OpenRouter and Google Gemini are not active subprocessors for Customer Content. If either is activated, it will be added to the active table before processing Customer Personal Data.

2. Independent controller

Provider	Purpose	Role
Paddle.com Market Limited and affiliates	Merchant of record, checkout, payments, subscriptions, invoices, tax, fraud, chargebacks, and refunds	Independent controller for transaction data; AccountMade receives limited transaction and entitlement metadata

3. Customer-selected providers

HubSpot, Salesforce, Google Drive, Microsoft 365/OneDrive/SharePoint, and Slack are used only when a customer connects them. They are normally the customer's own providers, acting under customer-approved scopes and their own terms. If Plain Works later engages one under its own account to process Customer Personal Data, it will be moved to the active table before use. Dormant or unprovisioned connectors are not active subprocessors.

4. Changes and objections

We provide at least 30 days' notice before a new or replacement subprocessor materially processes Customer Personal Data, except urgent security, legal, availability, or continuity needs may require shorter notice. DPA customers may object on reasonable data-protection grounds within 14 days. See the DPA for the resolution process.

5. Change log

Date	Change
October 12, 2026	OpenAI added as the backup AI generation provider, used only when Anthropic returns an error; OpenRouter and Google Gemini code paths removed. No customer DPAs were in force (pre-launch).
October 11, 2026	Application hosting moved to Vercel (Cloudflare now provides DNS only); Anthropic added as the AI generation provider; OpenAI limited to embeddings and image tagging; Google Gemini removed from the active list.
October 11, 2026	No customer DPAs were in force on October 11, 2026 (pre-launch), so the 30-day subprocessor notice in section 4 did not apply to the changes above.
October 1, 2026	Consolidated analytics and exception diagnostics under PostHog; removed retired providers.
September 7, 2026	Added the inactive OpenRouter qualification disclosure and its enforced routing controls.
August 25, 2026	Consolidated the legal entity and AI retention boundary; refreshed provider roles.

Questions and notice requests: hello@accountmade.com