Subprocessors
Version 1.3.0 · Last updated August 3, 2026
We use the third-party service providers (“subprocessors”) below to deliver the Service. Each processes personal data only under a data-processing agreement and only for the stated purpose. This same list backs Schedule 3 of our Data Processing Addendum.
| Vendor | Purpose | Data processed | Region | Transfer | Retention | Status |
|---|---|---|---|---|---|---|
| Supabase | Primary application database (Postgres + pgvector), authentication, file storage | Host account & profile data, property/brain content, guest identities (hashed contacts), embeddings | EU (Frankfurt) / US — project-dependent | SCCs | For the life of the account; deleted on erasure request (billing/legal records retained) | Active |
| Vercel | Application hosting, edge network, serverless compute | Request metadata, IP addresses, logs | US / global edge | SCCs | Transient; logs per Vercel retention policy | Active |
| Stripe | Payment processing and subscription billing | Host billing contact, payment card data (held by Stripe, never by us), invoices | US / EU | SCCs | Per Stripe policy and tax/accounting law (typically 7+ years for financial records) | Active |
| OpenAI | AI subprocessor — text embeddings (text-embedding-3-small), guest-intent classification, and the fallback path for all chat completions if model routing is unavailable | Guest questions and property knowledge context (PII redacted before external routing where applicable) | US | SCCs | API inputs/outputs retained up to 30 days for abuse monitoring, then deleted (no training on API data) | Active |
| OpenRouter | AI model router — directs completion requests to a task-appropriate model (currently Google Gemini 2.5 Flash for guest answers, OpenAI GPT-4o-mini and Meta Llama 3.1 for background extraction/classification) with automatic failover between models | Prompt content only, with personal data programmatically redacted before the request leaves our infrastructure: guest questions and the relevant property knowledge context. A post-redaction check blocks the external request entirely if personal data is still detected. No guest identity, contact details, or account data are sent. | US (routes to model providers in the US/EU) | SCCs | Zero-Data-Retention enforced on every request: prompts and responses are not logged or retained by OpenRouter, and any downstream model provider that would collect or train on the data is refused (the request fails closed and falls back to our primary provider instead) | Active |
| Resend | Transactional email delivery (host notifications, escalations) | Host email address, notification content | US | SCCs | Delivery logs per Resend policy | Active |
| Twilio | SMS delivery for guest verification one-time codes | Guest phone number, one-time verification code | US / global | SCCs | Message logs per Twilio policy | Active |
| Firecrawl | Host-initiated URL ingestion (fetch & extract public listing/content pages) | URLs submitted by the host and the fetched page content | US | SCCs | Transient; extracted content stored in the host’s Property Brain | Active |
| Sentry | Application error monitoring and performance tracing | Error events, stack traces, request metadata (PII scrubbed where feasible) | US / EU | SCCs | Per Sentry retention settings (typically 90 days) | Active |
| Cloudflare | Bot mitigation (Turnstile) on guest verification and edge protection | IP address, challenge token, request metadata | Global edge | SCCs | Transient challenge data | Active |
| Mapbox | Address autocomplete/geocoding, nearby place discovery, and static map images on the host dashboard | Property address strings and coordinates entered by the host, plus the host browser’s request metadata (IP, referrer) when a static map image loads. No guest identity or guest message content is sent. | US | SCCs | Query logs per Mapbox policy; results cached in the host’s own property records | Active |
| PostHog | Product analytics (host-side usage; no guest PII sent) | Pseudonymous host user id, product events, page views | US / EU (cloud region dependent) | SCCs | Per PostHog project retention settings | Active |
| Trigger.dev | Background job orchestration (async task execution and retries outside the request/response cycle) | Task payloads we choose to send. Jobs are designed to carry row/record ids only, never guest PII directly — the job re-reads any needed data from Supabase using the service role at execution time. | US | SCCs | Run logs and payloads retained per Trigger.dev account settings | Active |
| Amazon Web Services (S3) | Private object storage for host-uploaded files and images, accessed only via short-lived presigned URLs so bytes never transit our app servers | Property-related images and documents the host uploads. Objects are stored under a per-property key prefix; no object is publicly accessible (all public access blocked, TLS-only bucket policy, server-side encryption at rest). | US (us-east-2) | SCCs | Objects retained until deleted by the host or removed per bucket lifecycle policy (noncurrent versions expire after 90 days) | Active |
AI model providers are reached through our model router (OpenRouter) under a zero-data-retention configuration; see the AI Policy for which models handle which task and the safeguards applied before any content leaves our infrastructure.