Subprocessors and Transfers
Current production suppliers and contractual launch gates.
Supabase
Database, Auth and private object storage in configured Frankfurt region (eu-central-1). DPA acceptance, current subprocessors and any support/transfer mechanism still require owner verification.
Vercel
Web hosting. Vercel’s current DPA states coverage for Pro and Enterprise services; Hobby is for personal/non-commercial use. The current SHEMANE plan could not be verified and must be confirmed or upgraded.
Railway
Persistent browser worker. Railway publishes a DPA incorporating SCC provisions, but execution/acceptance and the worker’s EU region must be confirmed and recorded.
Resend
Transactional email. Resend publishes a DPA; service/account data may be processed or stored in the United States even with EU email delivery. Execute the DPA and document the transfer safeguard and assessment.
Changes
No analytics or marketing processor is currently used. A new processor must pass review, have a documented role and transfer basis, and be listed before receiving customer data.
Last substantive version: 2026-09-16. Seek qualified Belgian legal advice before relying on this draft for commercial contracting.