Current providers
| Provider | Role | Data involved | Processing location / transfer basis |
|---|---|---|---|
| Clerk | Authentication and account profiles | Email, optional name and avatar, session and security data | Regions and safeguards described by Clerk's DPA |
| Vercel | Website and API hosting, request security, AI Gateway | Request metadata; managed-AI content only when invoked | Regions and safeguards described by Vercel's DPA |
| CapyDB / Hetzner | Managed PostgreSQL database | Account, license, device, usage, capture text, encrypted vault metadata | EU infrastructure in Finland |
| Cloudflare R2 | Object storage | Temporary capture attachments and client-encrypted vault objects | Cloudflare network; contractual transfer safeguards apply where needed |
| Resend | Transactional email delivery | Recipient email, license-delivery and service-message content | Safeguards described by Resend's DPA |
| AI model providers selected through Vercel AI Gateway | Optional managed AI inference | The request content you choose to submit | Provider and region may vary by the routed model; see AI Privacy |
Independent provider
Polar is the merchant of record for purchases. It handles payment, tax, invoicing, refunds, and billing records under its own customer terms and privacy responsibilities. It is listed here for transparency but is not treated as an Anasa subprocessor for all payment processing.
Bring-your-own-key providers
When you configure your own AI provider key, that provider acts under your direct agreement. The request does not pass through Anasa servers, so the provider is not an Anasa subprocessor for that request.
Change notification
Email hey@anasa.md with “Subprocessor updates” in the subject to subscribe. We will use that address only for material additions or replacements to this list. Customers may object on reasonable data-protection grounds as described in the DPA.