| Sub-processor | Purpose | Data class | Region | Compliance |
|---|---|---|---|---|
| Vercel | Hosting and CDN | App traffic, request metadata | US / EU multi-region | SOC 2 II, ISO 27001 |
| Supabase | Primary database (Postgres + pgvector) | Briefs, assets metadata, audit log | eu-west-1 (Ireland) | SOC 2 II, GDPR |
| Inngest | Durable workflow orchestration | Workflow events | us-east-1 | SOC 2 II |
| OpenAI | LLM, embeddings, transcription, images | Step-scoped customer content | US | SOC 2 II · no training on customer data |
| Anthropic | Long-context LLM (Claude) | Step-scoped customer content | US | SOC 2 II · no training on customer data |
| Clerk | Authentication | Identity metadata | US / EU | SOC 2 II |
| ElevenLabs | Text-to-speech (spoken replies) | Reply text sent for synthesis | US | SOC 2 II |
| PostHog | Product analytics + error monitoring | Event data + scrubbed error context | EU | GDPR-compliant deployment |
| Microsoft Clarity | Site analytics (session replays + heatmaps) | Anonymised interaction data, consent-gated | US / EU | SOC 2 II, GDPR |
| Tag Manager + site analytics | Anonymised usage data, consent-gated | US / EU | ISO 27001, GDPR | |
| Stripe | Billing and invoicing | Billing contact, invoices | US / EU | PCI-DSS L1 |
| Resend | Transactional email + broadcasts | Recipient addresses, subject + body, open/click events | US | SOC 2 II |
| Ayrshare | Social publishing relay (LinkedIn, X, TikTok, Pinterest, Threads, YouTube) | Post copy, media, connected-account tokens | US | SOC 2 II |
| Meta | Facebook + Instagram publishing (direct) | Post copy, media, page access tokens | US / EU | ISO 27001 |
| fal.ai | Image + video generation (FLUX, fallback lane) | Brand-grounded prompts, reference and start images | US | SOC 2 II |
| Google Cloud | Video generation (Veo) + Places/Maps business lookup | Prompts, start images, business name + location | US / EU | ISO 27001, SOC 2 II |
| DataForSEO | Search-term and competitor research | Business type, location, website domain | US / EU | GDPR-compliant processing |
| Twilio | WhatsApp + SMS replies (optional, off unless connected) | Phone number, message text | US / EU | SOC 2 II, ISO 27001 |
We are not SOC 2 or ISO 27001 certified. The certifications listed for our sub-processors belong to those vendors. Our policy pack is drafted; the formal programme and audit are not scheduled.
Change notification
Customers can subscribe to sub-processor updates by emailing gethelp@marketeerlabs.com. Material changes (new vendor, new region, new data class) are notified at least 30 days in advance.
For DPAs, security questionnaires, or audit reports, see the security page or write to gethelp@marketeerlabs.com.