This page is a draft. It describes what we do today, but a lawyer has not reviewed it yet, it may change before it is published, and it creates no obligation until then.
What a sub-processor is
A sub-processor is a company Everseed engages to process Customer data on its behalf so that Gobuso can work. Each one receives only the data it needs for its job and is bound by contract to use it for nothing else and to protect it.
Who they are, and where they run
- Supabase: database, sign-in and file storage. Holds all Customer data, accounts and backups. Runs on AWS in the United States (Oregon, us-west-2).
- Vercel: hosts the application and delivers its pages. Processes requests and responses as they pass through; does not store Customer data. United States, with a global delivery network.
- OpenRouter: AI gateway that routes each AI request to a model provider. Receives the text of the request, which may include values from your records. United States.
- AI model providers reached through OpenRouter: generate the AI output. Today these include Anthropic and the providers that host open-weight models we use. Which provider handles a request can change between requests. United States and other countries.
- Resend: sends sign-in codes and invitations. Receives the recipient’s email address, the inviter’s name and the company’s name. United States.
How we choose them, and what binds them
Before we use a sub-processor we review its security and privacy practices. We choose providers that hold independent security certifications, such as SOC 2, where the work calls for it. Each one is bound by a data processing agreement, or terms to the same effect, that limits its use of the data to providing its service to us, requires appropriate security, and requires it to tell us of a breach. Everseed remains responsible to you for the work of its sub-processors.
Changes to this list
We update this page before a new sub-processor starts processing Customer data, and change the date at the top. For a material change we will also tell account owners by email at least 30 days in advance, unless an urgent change is needed to keep the Service secure or running, in which case we will tell you as soon as we can.
If you object to a new sub-processor on reasonable data protection grounds, write to team@gobuso.com within those 30 days. We will try to find a solution. If we cannot, you may end your use of the Service before the change takes effect.
Other providers we use
We also use providers that do not process Customer data, such as for source code hosting, domain registration and our own email. They are not sub-processors and are not listed here.