EasyPPAP uses the following sub-processors to provide the Service. Each is bound by a written agreement requiring it to process personal data only on EasyPPAP's instructions and consistent with our Privacy Policy.
| Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | LLM inference for analysis | USA (us-east) | SCC Module 2 + Anthropic ZDR addendum |
| MongoDB, Inc. | Database hosting (MongoDB Atlas) | USA (us-east-1) | SCC Module 2 |
| Supabase, Inc. | File storage (PPAP Material + reports) | USA (us-east-1) | SCC Module 2 |
| Vercel, Inc. | Web application hosting and edge | USA (multi-region) | SCC Module 2 |
| Stripe, Inc. | Payment processing | USA / EU | SCC Module 2 |
| Resend, Inc. | Outbound email delivery | USA | SCC Module 2 |
| Cloudflare, Inc. | DNS, inbound email routing, WAF | USA / global | SCC Module 2 |
| Sentry (Functional Software, Inc.) | Error tracking with PII scrubbing | USA / EU option | SCC Module 2 |
| PostHog | Product analytics with autocapture denylist | USA / EU option | SCC Module 2 |
| Upstash, Inc. | Redis for rate limiting | USA | SCC Module 2 |
Notification of Changes
EasyPPAP will provide thirty (30) days advance notice before adding a sub-processor that materially increases the geographic footprint of personal-data processing, allowing Customers to object on reasonable grounds.
To subscribe to notifications about sub-processor changes, email admin@easyppap.com with subject line "Sub-processor notifications".
Data Privacy Framework (DPF)
EasyPPAP does not currently hold a Data Privacy Framework (DPF) certification. SCC remains the primary transfer mechanism. DPF certification is under evaluation for Year 2.
⚠️ Draft notice: This list is provisional and reflects the architecture of EasyPPAP V1. Final list and transfer mechanisms will be confirmed with counsel before public launch. Questions: admin@easyppap.com.