Sub-processor List
ChartPull uses the following third-party service providers (sub-processors) to deliver our service. Each sub-processor processes data only as necessary for their specific function and is bound by contractual obligations to protect your data.
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN, serverless compute, edge network | HTTP request metadata, session cookies, application logs | United States (global CDN) |
| Neon Inc. | Managed PostgreSQL database | Tenant metadata, user accounts, subscription data, audit logs, custom field definitions | United States (AWS us-east-1) |
| Google Cloud Platform | Google Workspace Admin Directory API (data source) | Google Workspace user profiles (names, emails, titles, departments, photos, manager relationships) | United States |
| Stripe Inc. | Payment processing and subscription management | Billing email, subscription status, payment metadata (no card data stored by ChartPull) | United States |
| Anthropic PBC | AI-powered features (search, insights, reports, data quality analysis) | Employee names, titles, departments (anonymised context for AI processing; not stored by Anthropic) | United States |
| Functional Software Inc. (Sentry) | Error monitoring and performance tracking | Error logs with PII redacted, request metadata, performance traces | United States |
| PostHog Inc. | Product analytics | Anonymised page views, feature usage events, device metadata | United States |
| Resend Inc. | Transactional email delivery | Recipient email addresses, notification content (trial reminders, digest emails, admin invitations) | United States |
| Svix Inc. | Outgoing webhook delivery (Integrations add-on) | Webhook event payloads (employee data with photos stripped) | United States |
| Upstash (via Vercel KV) | Rate limiting, temporary caching | Rate limit counters (keyed by IP/tenant), cached directory data (15-minute TTL) | United States |
| Cloudflare Inc. | Bot protection (Turnstile CAPTCHA) | Browser fingerprint data, challenge tokens | Global |