Subprocessors
Subprocessor list
Effective date: 2026-10-29. This list is not a promise that every listed provider is enabled for every customer.
How to read this list
The facts, provider by provider.
Last checked: 2026-10-27 for Supabase; 2026-11-04 for Oracle; 2026-10-24 for Resend and the not-active providers; all other rows 2026-10-10. Provider terms, locations, and lists can change.
NZWE, Inc. is a Delaware C Corporation serving US small businesses. It processes customer business data as a service provider or processor, as applicable. The service is in private preview for invited accounts. A customer may not have every integration or model provider enabled.
The location statements below describe the current repository-backed position, not a general residency warranty. Location facts: The private application runtime was retired on 2026-10-11 and no customer runtime is active. The Supabase control plane is the US East project in us-east-1, live since the 2026-10-25 cutover. The former Sydney Supabase project was deleted in October 2026 after a final encrypted backup. An Oracle Cloud host in Sydney, Australia is retired from application use and is now used for CI only, with no active processing, and no customer data was found by file name on either of our Oracle hosts (Sydney and Singapore) when checked on 2026-11-04. The AWS Lightsail host and the S3 backup bucket are in us-east-1. A scheduled job uploads daily encrypted backups of control-plane account and sign-in data to the bucket since 2026-10-27, and objects expire after 30 days. No public US data-residency claim is made on the basis of these facts.
"Customer-directed source" means the customer connects and authorizes the source. It is listed for transparency even though NZWE, Inc. may not have selected it as a vendor on the customer's behalf.
Current and planned providers
Providers, roles and locations.
Current location rows marked 2026-10-24, 2026-10-27 or 2026-11-04 were re-checked then; others are as of 2026-10-10.
Supabase
Role and purpose. Control-plane database and authentication. The control plane stores account, billing, provisioning, membership, and usage metadata. Customer business data is not intended to be stored there. The contracting party named in Supabase's published DPA (supabase.com/legal/dpa, read 2026-11-11) is Supabase Pte. Ltd. (Singapore). Support and log locations are unverified.
Data categories that may be processed. Names, work email addresses, authentication records, workspace and membership metadata, billing and usage metadata, support or security records.
Current location. US East, us-east-1, live since the 2026-10-25 cutover. The former Sydney project was deleted in October 2026 after a final encrypted backup.
Planned location. US East, us-east-1. No further move planned.
Public provider privacy or DPA source. Supabase subprocessor list (Supabase legal pages, customer resources section); Supabase DPA (Supabase legal pages, customer resources section).
Oracle Cloud
Role and purpose. Retired application runtime (2026-10-11); the host is now used for CI only. No active processing. No customer data was found by file name on either of our Oracle hosts (Sydney and Singapore) when checked on 2026-11-04.
Data categories that may be processed. No active processing. Previously held application runtime state.
Current location. Sydney, Australia.
Planned location. No planned move.
Public provider privacy or DPA source. Oracle Cloud contracts page; Oracle Cloud DPA. Oracle's current cloud subprocessor list is delivered through its customer support portal, as described on its supplier security page.
AWS Lightsail
Role and purpose. Approved pilot host, us-east-1, Docker only, no customer data. Terms not yet verified.
Data categories that may be processed. None.
Current location. US East, us-east-1.
Planned location. US East, us-east-1.
Public provider privacy or DPA source. Link recorded, not fetched.
AWS S3
Role and purpose. Off-site backup destination, us-east-1. A scheduled job uploads daily encrypted backups of control-plane account and sign-in data since 2026-10-27, with 30-day prefix expiry. Terms not yet verified.
Data categories that may be processed. Control-plane encrypted backup archives.
Current location. US East, us-east-1.
Planned location. US East, us-east-1.
Public provider privacy or DPA source. Link recorded, not fetched (AWS DPA).
Netlify
Role and purpose. Hosting and delivery for the marketing site and web application, including global edge delivery.
Data categories that may be processed. Site and deployment metadata, account and access metadata, request metadata, and any content sent to hosted application endpoints. The current design does not intentionally store customer business data in Netlify.
Current location. Global CDN and edge network. Netlify origin processing location for this site is not verified. Global delivery is not a US-residency claim.
Planned location. No separate Netlify relocation is approved.
Public provider privacy or DPA source. Netlify Trust Center (not a DPA).
Resend
Role and purpose. Authentication email (sign-in) for invited accounts, us-east-1; ACTIVE (confirmed 2026-10-24: recovery and invitation mail). Customer email replies and Gmail are not available. Transactional and notification email is not enabled for customers.
Data categories that may be processed. Recipient email address, sender and recipient metadata, authentication or notification message content, delivery events, and support metadata.
Current location. US East, us-east-1, as recorded in the US transition issue. Provider-specific account and message retention details remain to be confirmed.
Planned location. US East, subject to provider configuration and confirmation.
Public provider privacy or DPA source. Resend DPA; Resend subprocessor list.
Google Analytics
Role and purpose. Google LLC, Mountain View, California. ACTIVE on the public marketing pages. Website analytics for the public marketing pages only.
Data categories that may be processed. Page address, referring page, approximate location (city level), browser and device type, random cookie identifiers, and time on page. We do not use Google advertising features or Google Signals. Google states that Google Analytics 4 does not log or store IP addresses; this is Google's statement, not a setting we control. The analytics code is not loaded in the customer application and receives no customer business content.
Current location. United States. Event data is kept for 2 months, the shortest setting.
Planned location. None planned.
Public provider privacy or DPA source. Google Analytics terms, fetched date to be re-checked before publication.
Sentry
Role and purpose. Functional Software, Inc. d/b/a Sentry, San Francisco, California. ACTIVE. Error monitoring for the application.
Data categories that may be processed. Error reports with the error message, stack trace, page address without query string or fragment, browser and device type, and release version. Our code does not send cookies, request bodies, user identifiers or query strings, and no customer business content is intentionally sent. The error message text is sent as written and is not scrubbed, so it could contain information from the page where the error happened.
Current location. United States, data storage region set to US.
Planned location. US, no separate relocation planned.
Public provider privacy or DPA source. Sentry DPA; Sentry subprocessor list.
Stripe
Role and purpose. NOT ACTIVE. Billing and subscription processing. Current use is a US sandbox configuration, not a claim that live billing is enabled.
Data categories that may be processed. Business contact details, customer and subscription identifiers, invoice and usage metadata, payment status, and payment method data handled by Stripe. Our systems are not designed to store full payment card numbers.
Current location. US, sandbox account, according to the US transition issue. Exact live account and processing path are not yet decided.
Planned location. US, subject to owner approval of the live billing account and tax setup.
Public provider privacy or DPA source. Stripe DPA; Stripe service providers and subprocessors.
Infisical
Role and purpose. Operator-only secrets management for service credentials and encryption keys. It is not intended to receive customer business data.
Data categories that may be processed. Operator account data, secret names and values, access and audit metadata. Customer business content is excluded by current operating rules.
Current location. Not verified. The current inventory does not establish a region.
Planned location. No customer-data residency target is asserted. Region and contractual setup must be confirmed before customer use.
Public provider privacy or DPA source. Infisical DPA; Infisical subprocessor list.
Google, when a customer connects Gmail
Role and purpose. NOT ACTIVE. Customer-directed mailbox source and, when separately authorized, an external action provider. The customer controls the connection and can revoke it.
Data categories that may be processed. Gmail message content and metadata, account identifiers, OAuth tokens, drafts, and any approved outbound message data.
Current location. Customer's Google account and Google's processing systems. A specific customer-data location is not controlled by NZWE, Inc. and is not verified here. Gmail is not enabled for every account.
Planned location. Per the customer's Google configuration. No US East or Sydney residency claim is made for Google-held data.
Public provider privacy or DPA source. Google Cloud Data Processing Addendum; Google Workspace user data and developer policy.
Anthropic, when enabled
Role and purpose. NOT ACTIVE. External model inference through an approved Anthropic commercial API arrangement.
Data categories that may be processed. Prompts, context, documents, audio transcripts, outputs, safety or abuse signals, and usage metadata sent for an enabled request.
Current location. Per the Anthropic service and account configuration. A product-specific location for this service is not verified. Do not describe Anthropic processing as Sydney or US East.
Planned location. Per the approved Anthropic service configuration.
Public provider privacy or DPA source. Anthropic Commercial Terms; Anthropic DPA.
OpenAI, when enabled
Role and purpose. NOT ACTIVE. External model inference through an approved OpenAI API arrangement.
Data categories that may be processed. Prompts, context, documents, audio transcripts, outputs, and usage metadata sent for an enabled request.
Current location. Per the OpenAI product, account, and processing configuration. A product-specific location for this service is not verified.
Planned location. Per the approved OpenAI service configuration.
Public provider privacy or DPA source. OpenAI DPA; OpenAI subprocessor list.
Google Gemini, when enabled as a model provider
Role and purpose. NOT ACTIVE. External model inference through an approved Google AI or Google Cloud arrangement. This is distinct from a customer-connected Gmail account.
Data categories that may be processed. Prompts, context, documents, audio transcripts, outputs, and usage metadata sent for an enabled request.
Current location. Per the selected Google AI service and account configuration. A product-specific location for this service is not verified.
Planned location. Per the approved Google service configuration.
Public provider privacy or DPA source. Google Cloud Data Processing Addendum; Gemini API terms.
Amazon Bedrock
Role and purpose. NOT ACTIVE. Prepared, disabled, zero calls. Terms not yet verified.
Data categories that may be processed. None while disabled.
Current location. Not applicable while disabled.
Planned location. Not approved for use.
Public provider privacy or DPA source. Not yet fetched.
GitHub, Inc. is recorded for source control and CI only, and is excluded from this list because no customer business data is processed there.
Opppa and Clockify are not on this list.
Model-provider rule
When a provider can receive data.
The service may use a private model runtime or an external model provider only when the relevant product configuration allows it, and we will give customers prior notice before enabling a provider. The exact provider, product tier, region, retention, and data-use terms must be recorded before customer business data is routed to that provider.
NZWE, Inc. does not use customer business data for its own model training, aggregation, or cross-tenant analysis. That statement does not replace provider-specific contractual review for any provider we enable.
Change control
Notice before a change.
When a subprocessor is added or replaced, we give customers 30 days notice and 14 days to object. If an objection is not resolved, the customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
Subprocessor questions