Subprocessors
Last updated: 2026-05-03. We notify customers by email at least 14 days before adding a new subprocessor; you may object during that window. Active subprocessors as of the date above:
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Primary database (Postgres), authentication, file storage. Holds your account, establishment, review, and audit data. | EU (eu-west-2) for UK / EU customers · US (us-east-1) for US customers |
| Vercel | Web hosting + edge network. Serves the dashboard + public surfaces + cron infrastructure. Logs include request IPs and user-agents (30-day retention). | Global edge; primary compute in IAD (US-East) and LHR (UK) |
| Stripe | Billing + payment processing. Holds your card details (we never see them) and your billing address. PCI-DSS Level 1. | EU entity for UK / EU customers, US entity for US customers |
| Anthropic (Claude) | AI reply generation + sentiment classification. Your review content + reply context are sent to the Claude API on demand. Anthropic does not train on API-tier customer inputs by default. | US |
| Resend | Transactional email (welcome, magic-link, urgent-review alerts, weekly digest, billing notifications). | US |
| Upstash | Rate-limit telemetry (Redis sorted sets keyed by IP / account / API key). Holds no PII; entries TTL within minutes to hours. | Global edge; primary in EU + US |
| Google Cloud Platform — Business Profile API | Source of truth for your Google reviews + business profile metadata. TapStellar holds OAuth tokens (encrypted at rest) so the review-sync cron can fetch on your behalf. | US (Google's GBP API) |
| Browserless | Headless-Chrome runner used by the v1.1 citation-submission engine + the Yell scraper. Screenshots of submission confirmations are stored in Supabase storage. | EU + US edge |
Notifications
Subscribe to subprocessor change notices: every TapStellar customer is opted in by default and we send the notice to the billing email on file. To change the recipient, update the billing email under Settings → Billing.