Subprocessors and Service Providers

Effective: September 7, 2026

1. DPA subprocessors and service providers

Not every provider receives every category. A provider processes Customer Personal Data only when the relevant feature or data flow is used.

Provider	Purpose	Typical data	Typical processing location
Vercel Inc.	Application hosting, serverless and edge delivery	Customer Content, requests, IP addresses, logs	United States and global edge
Supabase Inc.	Database, authentication, object storage	Account Data, Customer Content, workspace and integration data	United States
Cloudflare, Inc.	DNS, CDN, DDoS and bot protection	IP addresses, headers, traffic and security logs, cached public content where applicable	Global edge
Upstash, Inc.	Cache, queues, rate limits, temporary job state	Pseudonymous identifiers, counters, transient operational data	United States or configured region
Resend, Inc.	Transactional email	Names, email addresses, message and delivery metadata	United States
Functional Software, Inc. (Sentry)	Error and performance diagnostics	Error events, stack traces, device data, limited diagnostic context	United States or configured region
PostHog, Inc.	In-product analytics where enabled	Pseudonymous usage and feature events, browser/device data	United States
Google LLC (Google Analytics 4)	Public marketing and documentation analytics	Public page events, coarse device/location and referral data; no intended Customer Content	United States and Google infrastructure locations
OpenAI, L.L.C.	Commercial API AI generation, extraction, evaluation, and embeddings	Prompts, selected source content, business context, generated output	United States
Google LLC (paid Gemini API)	Commercial API AI generation, extraction, and evaluation	Prompts, selected source content, business context, generated output	United States and Google infrastructure locations
TrueClara	Aggregate behavioral and revenue telemetry	Pathnames without query strings, aggregate timing, pseudonymous workspace/revenue events	United States
Channel Corp. (Channel.io)	Support chat, if enabled	Contact details, chat content, support and device metadata	Republic of Korea and provider locations

AI providers are used through commercial accounts with no-training restrictions. AccountMade disables provider storage where supported and limits ordinary provider abuse-monitoring retention to 30 days unless a verified zero-retention setting applies.

OpenRouter is under qualification and is not an active subprocessor for Customer Content. The inactive integration requires a named provider allowlist, disables provider fallback, denies data collection, and requires a Zero Data Retention endpoint for each request. If activated, OpenRouter and the selected underlying provider will be added to the active table before processing Customer Personal Data.

2. Independent controller

Provider	Purpose	Role
Paddle.com Market Limited and affiliates	Merchant of record, checkout, payments, subscriptions, invoices, tax, fraud, chargebacks, and refunds	Independent controller for transaction data; AccountMade receives limited transaction and entitlement metadata

3. Customer-selected providers

HubSpot, Salesforce, Google Drive, Microsoft 365/OneDrive/SharePoint, and Slack are used only when a customer connects them. They are normally the customer's own providers, acting under customer-approved scopes and their own terms. If Plain Works later engages one under its own account to process Customer Personal Data, it will be moved to the active table before use. Dormant or unprovisioned connectors are not active subprocessors.

4. Changes and objections

We provide at least 30 days' notice before a new or replacement subprocessor materially processes Customer Personal Data, except urgent security, legal, availability, or continuity needs may require shorter notice. DPA customers may object on reasonable data-protection grounds within 14 days. See the DPA for the resolution process.

5. Change log

Date	Change
September 7, 2026	Added the inactive OpenRouter qualification disclosure and its enforced routing controls.
August 25, 2026	Added Google Analytics 4; consolidated the legal entity and AI retention boundary; refreshed all provider roles.

Questions and notice requests: legal@accountmade.com