Sub-processors
Traceable engages the following sub-processors to deliver the platform. All sub-processors are contractually bound to handle data in accordance with GDPR and are restricted to processing only the data necessary for their specific function.
Customer data is stored on EU infrastructure. Vercel runs the platform only in its Dublin region (dub1). Requests pass through Vercel's global edge network on their way there, and only content that is the same for every visitor is cached at the edge: static files, pre-built pages such as the sign-in page, and public passport pages. Customer data that is not public is not cached at the edge. Resend sends email from Ireland (eu-west-1) but keeps its records of each email, including email metadata, logs and API records, in the United States. Both are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. The platform is not routed through Cloudflare, which only answers DNS lookups for it; Cloudflare also protects the public website and docs site. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. Neither AWS nor Anthropic uses inputs or outputs to train models, and Anthropic has no access to them. Traceable's own personnel in India access customer data to operate and support the platform, under the Standard Contractual Clauses in Traceable's Data Processing Agreement. The Subprocessors page is the authoritative list of each provider's contracting entity, location and transfer mechanism.
Active Sub-processors
| Provider | Service | Data processed | Infrastructure region | DPA / SCCs |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All application data: user accounts, company data, DPP product records, uploaded documents, audit logs, session tokens | EU, Ireland (AWS eu-west-1) | Supabase DPA + AWS SCCs |
| Vercel | Application hosting, serverless functions, edge network | Request/response data transiting the application layer; no persistent storage | EU, Dublin, Ireland (dub1); requests pass through Vercel's global edge network | Vercel DPA (Standard Contractual Clauses); EU-U.S. Data Privacy Framework |
| Resend | Transactional email delivery | Email address, name, email content (notifications, account confirmations, data request notifications) | Email sent from Ireland (eu-west-1); email records stored in the United States | Resend DPA (Standard Contractual Clauses); EU-U.S. Data Privacy Framework |
| Sentry | Error monitoring and performance tracing | Error stack traces and platform performance metrics. Error reports are scrubbed of request bodies, cookies and credentials before they are stored in Sentry's EU region. | EU — Germany (Sentry EU, de.sentry.io) | Sentry DPA |
| Axiom | Log collection for the platform | The platform's application and request logs, received through the hosting provider's integration | European Union (AWS EU Central 1) | |
| Upstash | Rate limiting (Redis) | API request metadata (IP address, API key hash, request timestamp) for rate limit counters; no DPP content | EU — Ireland (AWS eu-west-1) | Upstash DPA |
| Amazon Web Services | AI processing and backup storage | Product and compliance content, and documents uploaded by operators and suppliers, sent to AI features that a user starts; backup copies of uploaded files | European Union | |
| Cloudflare | DNS for Traceable domains; CDN and network protection for the public website and docs site | Website and docs visitors' IP addresses and request metadata; no platform customer data, because the platform is not routed through Cloudflare | Global network | Cloudflare DPA (Standard Contractual Clauses); EU-U.S. Data Privacy Framework |
Sub-processor Details
Supabase
Role: Primary data processor — all Traceable customer data is stored in Supabase's PostgreSQL database and object storage.
Data: User accounts, company profiles, all DPP product data, uploaded compliance documents, audit logs, supplier and material data.
Security: Supabase states that it is SOC 2 Type 2 compliant and ISO 27001 certified (supabase.com/security).
Sub-processor disclosure: Supabase uses AWS as its infrastructure provider. AWS eu-west-1 (Ireland) is the hosting region. AWS is subject to the AWS-Supabase SCCs.
Vercel
Role: Application hosting — the Traceable web application and API run on Vercel's serverless platform.
Data: Vercel processes request and response payloads in transit. Vercel does not store application data; all persistence flows through to Supabase. Vercel may retain access logs (IP addresses, request paths, status codes) for a limited period for platform stability purposes.
Security: Vercel states that it holds a SOC 2 Type 2 attestation and is ISO 27001 certified (vercel.com/security).
Resend
Role: Transactional email delivery — used for platform notifications, account confirmations, data request alerts, and team invitation emails.
Data: Recipient email address, sender name, email subject and body. Email content may include DPP-related notification context (product names, request deadlines) but does not include full DPP data or personal data beyond the recipient's email address.
Retention: Email delivery logs retained per Resend's standard policy (typically 90 days).
Sentry
Role: Error monitoring — used to capture application errors and performance traces to support platform stability.
Data: Error stack traces, browser/environment metadata and request paths. Application error and performance monitoring. Receives exception data, stack traces and performance traces. Error reports are scrubbed of request bodies, cookies and credentials before they are stored in Sentry's EU region.
Retention: Error events retained for 90 days.
Axiom
Role: Log collection for the platform.
Data: Receives the platform's application and request logs through the hosting provider's integration. Hosted in the European Union (AWS EU Central 1).
Upstash
Role: Rate limiting. Sign-in, sign-up and one-time code requests are rate limited.
Data: API request metadata: IP address, API key identifier (hash), and request timestamp. Used only to maintain rate limit counters. No DPP content, no personal data beyond IP address is processed or retained beyond the counter window (typically 60 seconds).
Amazon Web Services
Role and data: AI processing and backup storage. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union; they receive product and compliance content, and documents uploaded by operators and suppliers, and run only when a user starts them. Neither AWS nor Anthropic uses inputs or outputs to train models, and Anthropic has no access to them. Backup copies of uploaded files are stored in the EU Ireland region.
Changes to Sub-processors
Traceable will provide 30 days' advance notice to operators before engaging any new sub-processor or making a material change to an existing sub-processor's role, where such change affects the processing of customer personal data.
Notifications will be published in the Changelog and, where a DPA is in place, communicated directly to the operator's registered contact.
Further Reading
| Page | Contents |
|---|---|
| Infrastructure | Hosting architecture and where customer data is stored |
| GDPR Implementation | Data subject rights and lawful bases |
| Data Encryption | Encryption standards |