Trust center

Sub-processors

This page lists the third-party service providers OneComply uses to deliver the platform. Customers should treat this as an operational disclosure, not a substitute for the signed DPA.

Last updated: May 19, 2026

Provider

Purpose

Data categories

Location notes

Supabase

Authentication, Postgres database, and object storage infrastructure

Account identifiers, tenant data, evidence metadata, and uploaded evidence files

EU-region project configuration

Vercel

Application hosting, edge network, deployment logs, and serverless execution

HTTP request metadata, application logs, and runtime telemetry

EU/EEA and global edge processing depending on visitor location

Stripe

Subscription checkout, billing portal, invoices, tax, and payment processing

Billing contacts, subscription records, payment metadata, and tax identifiers

Stripe global processing with GDPR transfer safeguards

Resend

Transactional email delivery for invites, alerts, billing, and operational notifications

Recipient email addresses, message metadata, and template content

GDPR-protected processing under Resend subprocessors

Sentry

Error monitoring, release health, and production diagnostics

Error traces, scrubbed request metadata, and diagnostic context

Configured Sentry project region and GDPR transfer safeguards

Upstash

Redis-backed rate limiting and operational queues where enabled

Rate-limit keys, request counters, and job metadata

Region configured per environment

Plausible

Privacy-preserving website analytics

Aggregated website usage data without cross-site tracking cookies

EU-hosted analytics processing

OpenAI

Optional AI-assisted generation and analysis features when enabled by the customer

Minimized prompts and generated outputs; Strict mode does not call AI services

Provider processing under applicable DPA and customer-approved mode

Customer notice

Material changes to this list are communicated through the contractual notice process. Customers can contact dpo@onecomply.eu for DPA, transfer, or vendor due-diligence questions.