Subprocessors

These are the vendors we use to run Gaugelog, what each one does, what data it sees, and where it runs. Your register and certificates are stored in the EU; the exceptions are named, not hidden. This list is referenced by our privacy policy and data processing agreement. The service is provided by Gaugelog AS.

Last updated 19 August 2026

Before adding or replacing a subprocessor, we update this page and email account owners at least 30 days in advance.

Supabase

Supabase, Inc. (US vendor; your data is hosted in the EU)

What it does: Database, authentication and file storage for the service
Data it sees: All account and register data: users, instruments, calibration records, certificates, uploaded files and the audit trail
Where it runs: Frankfurt, Germany (AWS eu-central-1)
Safeguard: Data is stored in the EU. Supabase's data processing agreement, with the EU standard contractual clauses covering any access from outside the EU

Vercel

Vercel Inc. (US vendor; the app is served from the EU)

What it does: Application hosting and content delivery
Data it sees: Request data passing through the application, including IP addresses and short lived server logs
Where it runs: Frankfurt, Germany (fra1)
Safeguard: The app runs in the EU region. Vercel's data processing agreement, with the EU standard contractual clauses

Postmark

ActiveCampaign, LLC (US)

What it does: Delivery of notification and account emails
Data it sees: Recipient email address, subject and message content (instrument names and due dates), and the delivery log
Where it runs: United States. Postmark has no EU data residency option
Safeguard: ActiveCampaign's data processing agreement, with the EU standard contractual clauses. Notification emails carry instrument names and dates, not sensitive personal data

Anthropic

Anthropic, PBC (US)

What it does: One step of the spreadsheet import: reading your column headers to suggest a mapping
Data it sees: Column headers and a few sample rows from the spreadsheet you upload, only when you use import
Where it runs: United States
Safeguard: Anthropic's data processing agreement, with the EU standard contractual clauses. Under Anthropic's commercial API terms this data is not used to train models. After you confirm the mapping, the import is deterministic and no AI touches your records

Stripe

Stripe Payments Europe, Ltd. (Ireland), with processing by other Stripe group companies

What it does: Subscription billing and payment processing
Data it sees: Company name, billing address, VAT or tax ID, and payment card details (card data goes to Stripe directly and never reaches Gaugelog servers)
Where it runs: EU and United States
Safeguard: Stripe's data processing agreement, with the EU standard contractual clauses

PostHog

PostHog, Inc. (US vendor; analytics data is hosted in the EU)

What it does: Product analytics, only if you allow it: which features are used, never form content or file contents
Data it sees: Usage events from a fixed allowlist (screen areas visited, feature actions, plan level). Names, emails, instrument data, file contents, full URLs and search terms are stripped before events leave the browser. Without your consent, usage is counted anonymously, without cookies or persistent identifiers
Where it runs: Frankfurt, Germany (PostHog Cloud EU)
Safeguard: PostHog's data processing agreement, with the EU standard contractual clauses. Analytics cookies and identifiers are set only after you choose Allow analytics, and you can withdraw that choice at any time

On the marketing site

Not a service subprocessor, listed here for completeness: Formspree (Formspree, Inc. (US)) handles feedback forms and the import-concierge support form and sees the feedback or support text you submit, the page it came from, and your email address when you choose to include it. spreadsheet files are never sent to formspree.

Need this list as a document for a procurement review, or a signed data processing agreement? Email hello@gaugelog.com and you get both.