Subprocessors
Version 1.1-draft (QC-035, Phase C Trigger.dev removal) · Last updated 27 August 2026
Orryn Quote Tracker uses a small number of service providers to operate the product. This page lists each one, what it is used for, and the categories of personal data it may process. It excludes internal credentials, project IDs, account IDs and security configuration. The full evidence and research behind this page is recorded in operations/compliance/PROVIDER-AND-SUBPROCESSOR-INVENTORY.md.
Processors and subprocessors
| Provider | Purpose | Data categories | Transfer/location note | Status |
|---|---|---|---|---|
| Vercel Inc. | Application hosting | Request metadata; no independent customer data store | Global infrastructure; SCC/UK Addendum-based transfer terms per Vercel's own DPA | Active production |
| Supabase Inc. | Database, authentication, file storage | Account, business, quotation and mailbox-derived data | Project pinned to a single configured region; subprocessors rely on EU-U.S. Data Privacy Framework or equivalent safeguards | Active production |
| Stripe, Inc. | Billing, subscriptions, invoices, payment methods | Billing contact details, subscription state; card data handled directly by Stripe, never by Orryn | Stripe-managed global infrastructure per Stripe's own DPA | Active production |
| Google (Gmail API / Google OAuth) | Gmail connection, mailbox reads, draft creation, sign-in | Sent-mail/tracked-thread messages and attachments, sender/recipient identities | Governed by Google's API Services User Data Policy, including Limited Use | Active production |
| Google Cloud Vertex AI (Gemini) | AI classification, extraction and draft-suggestion assistance | Minimised subject/message text, confirmed quotation fields -- never full mailbox or private notes | Google Cloud Data Processing Addendum; production region not yet configured | Planned for launch |
Connected services (not conventional subprocessors)
Web Push notifications are delivered through the visitor’s own browser/OS push service, which is inherent to the Web Push standard rather than a provider Orryn Quote Tracker selects or contracts with directly.
| Provider | Purpose | Data categories | Transfer/location note | Status |
|---|---|---|---|---|
| Browser/OS push services (e.g. Google FCM, Mozilla Push, Apple Push) | Delivering encrypted Web Push notifications to a subscribed device | Encrypted payload and delivery metadata only; the push vendor cannot read notification content | Determined by the visitor's own browser, not selected or contracted by Orryn | Connected service |
Evaluation-only providers (not production subprocessors)
During AI provider evaluation, OpenAI API and Anthropic API candidates were tested against a sanitised evaluation corpus only. Neither is used in production, and neither receives real customer data.
Changes to this list
We will update this page when we add, remove or materially change a subprocessor, and will give reasonable advance notice of a new subprocessor with a material impact on your data, consistent with our Data Processing Terms.
Contact
Questions about a specific subprocessor: support@orryn.studio.