Active third parties in the data-processing stack
Subprocessors
Last updated: June 20, 2026
The following third-party service providers process personal data as part of the Trailmaker platform. Changes are announced to existing customers at least 30 days in advance by email (see DPA §6).
| Name | Purpose | Region | Transfer mechanism | Legal docs |
|---|---|---|---|---|
| Supabase (Inc.) | Postgres database, authentication, realtime, edge functions, storage | EU (Frankfurt) | No third-country transfer (EU/EEA only) | Documents |
| Vercel (Inc.) | Frontend hosting (Next.js), edge CDN, serverless API routes | EU + global CDN | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Google Cloud (Google Ireland Limited) | Engine hosting on Cloud Run (europe-west1), Vertex AI for the Gemini router | EU (Belgium, europe-west1) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Anthropic (PBC) | Claude Sonnet 4 for strategy outputs (prompt + completion) | USA | Standard Contractual Clauses (SCC, 2021) + TIA | Documents |
| Stripe (Payments Europe Limited) | Billing, payment processing, invoicing, webhooks | EU (Ireland) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Resend (Resend, Inc.) | Transactional + onboarding emails (welcome, day-3 check-in, day-6 conversion). Supabase auth emails run separately. | EU (trailmaker.app domain verified in EU region) | No third-country transfer (EU/EEA only) | Documents |
| Meta Platforms Ireland Limited | Meta Pixel + Conversions API (ad attribution, conversion tracking, custom-audience building). Loaded only after consent in the consent banner. Processes IP, user agent, _fbp/_fbc cookies, and for logged-in users hashed identifiers (email, external user ID, name, country from billing data). | EU (Ireland) as contracting party; data export to Meta Platforms, Inc. (USA, parent company) | DPF + SCC fallback | Documents |
| PostHog (PostHog, Inc.) | Product analytics (identified users only). Session replay is disabled. Loaded only after consent in the consent banner. | USA (us.posthog.com) | Standard Contractual Clauses (SCC, 2021) + TIA | Documents |
| Sentry (Functional Software, Inc.) | Error and performance monitoring (stack traces, anonymized request data — sendDefaultPii=false, header scrub on authorization/cookie/set-cookie). | USA (Sentry Cloud) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
Changes
When we add new subprocessors or replace existing ones, we notify registered Enterprise and Agency customers by email at least 30 days before they take effect. In this case the Customer has an extraordinary right of termination under § 26 BDSG if the replacement would be unreasonable for them.