Last updated: August 3, 2026 · Version française
Subprocessors
DesignVault uses the following subprocessors to provide the service. This list constitutes Exhibit B of our Data Processing Agreement.
| Company | Role | Location |
|---|---|---|
| Supabase, Inc. | Database hosting, authentication, file storage | Canada (AWS ca-central-1, Toronto) |
| Vercel, Inc. | Application hosting and content delivery; privacy-preserving Web Analytics and Speed InsightsWeb Analytics and Speed Insights run only after you opt in via the cookie banner | United States (global CDN) |
| Stripe, Inc. | Payment processing and billingIndependent controller for payment card data | United States |
| Resend, Inc. | Transactional email delivery | United States |
| OpenAI OpCo, LLC | Artificial intelligence (auto-tagging, embeddings, semantic search)Only if AI features are enabled by your organization. No permission to train models on your data. | United States |
| Functional Software, Inc. (Sentry) | Error monitoring and observabilityConfigured without personal data: no IP addresses, cookies, or request bodies are sent. Session Replay (masked text and inputs, media blocked) runs only after you opt in via the cookie banner. | United States |
| Google LLC (Google Analytics 4, Google Tag Manager) | Audience measurement and tag managementBoth run only after you opt in via the cookie banner. Event and user-level data is retained for 14 months. No advertising features, no Google Signals, no data sharing enabled for Google product improvement. Tag Manager runs under Google Consent Mode v2: advertising signals stay denied unless you also opt into Marketing. | United States |
| Upstash, Inc. | Rate limiting and abuse protection | United States |
| Figma, Inc. (Adobe) | Design file API (asset import)Separate controller — governed by your own Figma agreement | United States |
Changes to this list
We will notify organization owners by email at least 30 days before adding or replacing a subprocessor that processes personal data. You may object on reasonable, data-protection-related grounds as described in our DPA.
Questions? Contact .
Change log
- August 10, 2026Added Google Tag Manager to the existing Google LLC entry — tag management, loaded only after opt-in via the cookie banner, with advertising signals gated on the separate Marketing choice (Google Consent Mode v2). No new subprocessor entity.
- August 3, 2026Added Google LLC (Google Analytics 4) — audience measurement, loaded only after opt-in via the cookie banner. Disclosed the 14-month analytics retention in the Privacy Policy (§8).
- June 10, 2026Added this change log. No subprocessor was added, removed, or replaced.
- June 6, 2026List published with the current 8 subprocessors.