Sub-processors
Last updated 17 October 2026
These companies process personal data on our behalf to run PortyLink. Each is bound by a data processing agreement with terms at least as protective as our DPA. Your data is stored in the European Union.
| Provider | Purpose | Data | Location and safeguards |
|---|---|---|---|
| SupabaseSupabase, Inc. | Database and sign-in | Accounts, organizations, sites, encrypted Google tokens, activity and request logs | Ireland (EU), AWS eu-west-1Stored in the EU; Standard Contractual Clauses for any support access |
| VercelVercel Inc. | Application hosting | All data passing through the app while a request is handled; request logs | Servers in Dublin, Ireland (EU); global network for deliveryStandard Contractual Clauses and the EU-US Data Privacy Framework |
| UpstashUpstash, Inc. | Short-lived cache and rate limits | Report results (up to a day), encrypted access tokens, rate-limit counters | Ireland (EU), AWS eu-west-1Stored in the EU; Standard Contractual Clauses |
| ResendResend, Inc. | Transactional email | Recipient email address, organization name, invitation and alert content | United StatesStandard Contractual Clauses |
Not sub-processors
- Google is the source of the Analytics and Search Console data you connect. We read it with the access you grant, under Google's terms with you.
- AI assistants and automations you connect (for example Claude, ChatGPT, Cursor or n8n) receive data because you authorized them to. Their providers handle it under their own terms with you.
Changes
We update this page at least 30 days before a new sub-processor starts handling customer personal data. If you object to a change, tell us at hello@portylink.com and we'll work with you on it. If we can't resolve it, you may stop using PortyLink and we'll delete your data.