Privacy
Sub-processors
Last updated: 8 September 2026
Every service that processes data on our behalf, what it does, and where it runs. 2 of them load only after you opt in via cookie settings, and 3 receive no personal data at all by design.
Swipe sideways for location and transfer safeguard. The service column stays in place.
| Service | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Authentication, database and file storage | EU (Ireland) | Processed inside the EU |
| Vercel | Hosting and edge delivery | EU region, company seated in the USA | EU Standard Contractual Clauses |
| Cloudflare | Domain registrar and authoritative DNS for invest-table.com, plus the Turnstile human-verification widget on the sign-in, sign-up and password-reset forms. The widget loads in the visitor's browser and checks the request before the credentials reach Supabase, processing IP address, browser signature and the page requested. Cloudflare does not proxy platform traffic: the DNS records are unproxied, so requests resolve straight to Vercel. | Global anycast DNS, company seated in the USA | EU Standard Contractual Clauses |
| Stripe | Payment processing and subscription billing | EU and USA | EU Standard Contractual Clauses |
| Resend | Transactional email (sign-in links, invitations, notifications) | EU region, company seated in the USA | EU Standard Contractual Clauses |
| Upstash | Rate limiting and session store | EU region | Processed inside the EU |
| HubSpotConsent required | CRM and marketing. Contact details submitted through a signup form sync to the CRM; the tracking script and the booking scheduler load only after consent. | EU region, company seated in the USA | EU Standard Contractual Clauses |
| PostHogConsent required | Product analytics | EU region | Processed inside the EU |
| Workspace hosts our business mailboxes, so anything you send to hello@, support@, legal@ or privacy@ is stored there. Search Console reports aggregated search performance, and YouTube serves the pitch video embeds behind a click-to-load facade. | USA | EU-US Data Privacy Framework | |
| OpenStreetMap NominatimNo personal data | Geocoding of the address a company enters | EU | Processed inside the EU |
| TavilyNo personal data | Sector, geographic and regulatory context retrieval | USA | EU Standard Contractual Clauses |
| AnthropicNo personal data | AI analysis for geo, market and Early Radar scoring. Receives business context only; the pipeline input types exclude every personal field and free text is scrubbed first. | USA | EU Standard Contractual Clauses |
Changes to this list
We update this page whenever a service is added or replaced. For questions about a specific processor, or to request the data processing agreement we hold with one of them, contact us at privacy@invest-table.com.