SUPPRESSED uses selected service providers to deliver, secure, operate, and support the platform.
This standard identifies service providers that may process customer data, personal data, account data, operational data, or service metadata on behalf of SUPPRESSED PTE. LTD.
The providers listed here do not necessarily receive every type of data. Processing depends on the specific service, feature, workflow, customer interaction, and operational requirement involved.
The Sub-processors listed below may process Customer Personal Data on our behalf. Other operational providers are listed separately and are not necessarily Sub-processors for Customer Personal Data.
Sub-processors
| Provider | Legal entity | Nature of processing | Region / jurisdiction |
|---|---|---|---|
| Cloudflare | Cloudflare, Inc. | DNS, web application firewall, bot protection, edge routing, security filtering, and network-layer protection | United States / global edge network |
| Cloudflare R2 | Cloudflare, Inc. | Object storage, archive storage, archived copies of uploaded files, suppression evidence, validation artifacts, and operational records | United States / provider infrastructure |
| Vercel | Vercel Inc. | Web hosting, deployment infrastructure, preview deployments, production deployments, and application delivery | United States |
| Supabase | Supabase, Inc. | Database, authentication, session management, file storage, backend functions, scheduled jobs, and application infrastructure | United States / configured project region |
| Stripe | Stripe Payments Singapore Pte. Ltd. / Stripe Payments Europe, Limited | Subscription billing, payment processing, invoices, tax records, payment records, and billing customer records | Singapore / Ireland / provider infrastructure |
| Resend | Plus Five Five, Inc. | Transactional email delivery and service notifications | United States |
| Anthropic | Anthropic, PBC | AI-assisted workflow processing and operational support | United States / provider infrastructure |
| Gemini | Google Asia Pacific Pte. Ltd. | AI-assisted workflow processing and operational support | Singapore / global provider infrastructure |
| OpenAI | OpenAI OpCo, LLC | AI-assisted workflow processing and operational support | United States / provider infrastructure |
| Perplexity | Perplexity AI, Inc. | AI-assisted workflow processing and operational support | United States / provider infrastructure |
| Better Stack | Better Stack, Inc. | Public status page, uptime monitoring, incident detection, and incident communication | United States |
Any listed AI provider may be used individually or in combination for any AI-assisted purpose described in this standard. Provider and model selection may vary according to capability, availability, sensitivity, data-minimization, security, quality-control, and operational requirements. No listed AI provider is assigned to a fixed model, capability, workflow, or stage.
Additional operational providers
The following providers support business, development, finance, communications, and operational workflows. They may process limited personal data, business records, source-control data, or operational metadata depending on the relevant workflow, but they are not part of the primary customer application data path unless stated.
| Provider | Legal entity | Purpose | Region / jurisdiction |
|---|---|---|---|
| GitLab | GitLab Inc. | Primary controlled source control and development workflow | United States |
| GitHub | GitHub, Inc. | Source control mirror, repository hosting, integration support, and public content repository | United States |
| Proton | Proton AG | Business email and internal communications | Switzerland |
| Airwallex | Applicable Airwallex contracting entity | Financial operations, foreign exchange, accounts, and business banking operations | Singapore / applicable Airwallex entity |
Processing roles
| Category | Purpose |
|---|---|
| Infrastructure | Hosting, DNS, routing, perimeter security, application delivery, and platform availability |
| Data systems | Database, authentication, sessions, storage, permissions, and operational records |
| Payments | Subscription billing, invoices, payment processing, tax records, and finance operations |
| Transactional service emails, account messages, and operational communications | |
| AI and automation | AI-assisted and automated workflows, including research, retrieval, reasoning, classification, extraction, drafting, summarization, multimodal analysis, automation, triage, prioritization, validation, quality control, monitoring, and suppression support |
| Monitoring | Uptime checks, incident detection, public status updates, and service communications |
| Development operations | Source control, deployment support, preview workflows, and public content management |
Data categories
Depending on the provider and service function, the following categories of data may be processed:
- account information;
- contact information;
- authentication and session data;
- billing and payment records;
- service configuration data;
- customer support and operational communications;
- uploaded files, suppression evidence, validation artifacts, or application records;
- service metadata, logs, and diagnostics;
- suppression workflow data;
- public content and documentation files.
Processing boundaries
AI-assisted providers are listed when they are used or configured to process customer data through the services. We may update this standard if we add, remove, replace, or materially change an AI-assisted provider.
Unless a customer expressly agrees otherwise, SUPPRESSED does not use customer data to train public foundation models and does not opt in to provider model-improvement or training programs that use customer data.
A provider's inclusion on this page does not mean that the provider receives all customer data or all personal data we process.
Access and processing are limited by the provider's role, the applicable system design, contractual arrangements, technical configuration, and operational need.
Providers that process customer data are expected to operate under appropriate confidentiality, security, and processing obligations for their role.
Where possible, we separate customer application workflows, billing workflows, authentication, storage, public content, monitoring, and internal operations across defined systems.
Changes to sub-processors
We may add, replace, or remove Sub-processors.
Where the Data processing addendum applies, we will notify affected Customers of intended additions or replacements in accordance with the notice and objection process in the DPA.
Current and historical changes may also be published in the Changelog.
Related pages
- Technology
- Security
- Privacy
- Service level agreement
- Changelog