Subprocessors
These are the vendors we use to run Gaugelog, what each one does, what data it sees, and where it runs. Your register and certificates are stored in the EU; the exceptions are named, not hidden. This list is referenced by our privacy policy and data processing agreement.
Last updated 8 July 2026
This page is a working draft prepared for legal review. [TODO: Kristian: remove this notice after counsel has signed off]
We give customers at least 30 days notice before adding or replacing a subprocessor. [TODO: Kristian: confirm the notice period and channel, aligned with the DPA]
Supabase
Supabase, Inc. (US vendor; data hosted in the EU)
- What it does
- Database, authentication and file storage for the service
- Data it sees
- All account and register data: users, instruments, calibration records, certificates, attachments, audit trail
- Where it runs
- Frankfurt, Germany (AWS eu-central-1)
- Safeguard
- Data is stored in the EU. Vendor DPA with standard contractual clauses covers any access from outside the EU. [TODO: Kristian: confirm the current Supabase DPA and transfer mechanism at legal review]
Vercel
Vercel Inc. (US vendor; app served from the EU)
- What it does
- Application hosting and content delivery
- Data it sees
- Request data passing through the application, including IP addresses and server logs
- Where it runs
- Frankfurt, Germany (fra1)
- Safeguard
- The app runs in the EU region. Vendor DPA with standard contractual clauses. [TODO: Kristian: confirm the current Vercel DPA and log retention at legal review]
Postmark
ActiveCampaign, LLC (US)
- What it does
- Delivery of notification and account emails
- Data it sees
- Recipient email address, subject and message content (instrument names and due dates)
- Where it runs
- United States. Postmark has no EU data residency option
- Safeguard
- DPA with standard contractual clauses (verified 4 July 2026). Notification emails carry instrument names and dates, not sensitive personal data
Anthropic
Anthropic, PBC (US)
- What it does
- One step of the spreadsheet import: reading your column headers to suggest a mapping
- Data it sees
- Column headers and a few sample rows from the spreadsheet you upload, only when you use import
- Where it runs
- United States
- Safeguard
- DPA with standard contractual clauses (verified 4 July 2026). Anthropic does not train on API data. After you confirm the mapping, the import is deterministic and no AI touches your records
Stripe
Stripe [TODO: Kristian: confirm the contracting Stripe entity for a Norwegian merchant, likely Stripe Payments Europe, Ltd. (Ireland)]
- What it does
- Subscription billing and payment processing
- Data it sees
- Company name, billing address, VAT or tax ID, payment card details (card data is handled by Stripe and never reaches Gaugelog servers)
- Where it runs
- EU and United States
- Safeguard
- Stripe Data Processing Agreement with standard contractual clauses
Planned, not yet in use
Vendors we plan to add and will confirm here, with notice, before any customer data reaches them.
PostHog
PostHog, Inc. (US vendor; EU cloud planned)
- What it does
- Product analytics: page views and interaction events, never form content
- Data it sees
- Usage events [TODO: Kristian: confirm scope and cookie behavior before enabling]
- Where it runs
- EU (PostHog Cloud EU, planned)
- Safeguard
- [TODO: Kristian: not in use today. Confirm DPA, cookie mode and this listing before the analytics setup goes live]
Sentry
Functional Software, Inc. (US)
- What it does
- Error monitoring
- Data it sees
- Error reports and request context [TODO: Kristian: confirm scope before enabling]
- Where it runs
- [TODO: Kristian: EU or US region, decided at setup]
- Safeguard
- [TODO: Kristian: not in use today. Confirm whether Sentry will be used at all, and its DPA, before enabling]
On the marketing site
Not a service subprocessor, listed here for completeness: Formspree (Formspree, Inc. (US)) powers the launch-updates signup form on the marketing site and sees the email address you type into the form, nothing else.
Need this list as a document for a procurement review, or a signed data processing agreement? Email hello@gaugelog.com and you get both.