Sub-processors
Last updated: October 2026. VendorAnswers acts as a processor for the data you upload. The following sub-processors may process personal data on our behalf.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, DNS, CDN, email routing | Website traffic, email metadata | Global (US) | SCCs, DPA |
| Supabase, Inc. | Database and file storage | Questionnaires, policies, intake data | US/EU (configurable) | SCCs, encryption at rest |
| Google LLC | Email inbox and workspace | Correspondence, attachments | Global (US/EU) | SCCs, DPA |
| Resend, Inc. | Transactional email delivery | Email address, message content | US | SCCs, DPA |
| Lemon Squeezy (Link, LLC) | Merchant of record: payments and invoicing | Name, email, billing data | US | MoR, PCI DSS, DPA |
| AI model provider (API) | Drafting assistance; no training on customer data | Questionnaire text and client documents (transient) | US/EU | API terms with no-training commitment [provider to be confirmed before first client] |
Changes
We will give at least 30 days' notice before adding or replacing a sub-processor. You may object on reasonable data-protection grounds; if we cannot accommodate the objection, you may terminate the affected service and receive a refund for the unperformed part.
Contact
Questions or objections: [email protected].