Draft for legal review. This is not signed counsel text and must not be quoted as a certification or a binding agreement.
Subprocessors
Last updated 19 October 2026.
Locations and DPAs are not signed. This list is the current intended set, not a claim that contracts are in place.
- Railway — API hosting and managed PostgreSQL.
- Vercel — web application and marketing site.
- Cloudflare R2 — file storage for documents and images (when configured).
- Transactional email provider (Resend or successor) — messages with links, not PHI.
- Product analytics (PostHog or successor) — not loaded today; only after cookie consent if added.