Subprocessors

Current providers

• Supabase: authentication, PostgreSQL database, file storage and related platform services. Data may include accounts, Customer Content, operational evidence and service logs.
• Vercel: web application hosting, delivery, runtime and deployment infrastructure, including Vercel AI Gateway. Data may include requests, IP and device information, and data processed transiently by application functions.
• OpenAI: configured model provider for the optional CRATARA Assistant, accessed through Vercel AI Gateway. The Assistant receives only the user's submitted question, limited recent Assistant conversation, selected language and page path; it is not connected to CRATARA workspace records.
• Google: identity provider only for users who choose Google sign-in. Data may include Google account identity and authentication information.

Billing and merchant of record

Paddle: checkout, subscriptions, invoices, payment-method administration and related billing communications. Paddle receives billing information needed to provide those services. CRATARA receives subscription, transaction and billing-status information needed to provision access and support the account; CRATARA does not receive or store payment-card numbers.

Changes

Providers may change as CRATARA evolves. Material additions that process Customer Content will be reflected here before or when they are placed into production, subject to emergency security or availability needs. A customer with a signed agreement may have additional notice or objection rights in that agreement.

Excluded tools

Software or services that a customer independently connects, exports to or uses outside CRATARA are not CRATARA subprocessors and remain the customer's responsibility.