Sub-processor register
Every third party that processes personal data on our behalf, referenced by the Data Processing Agreement. We keep this list current and notify customers of additions with at least 14 days' notice.
Current sub-processors
| Sub-processor | Purpose | Data involved | Location | Status |
|---|---|---|---|---|
| Supabase (Supabase Inc.) | Database hosting, authentication, and file storage for the platform | All account, connected-source, and derived-score data | EU (eu-central-1, Frankfurt) | Always active |
| Anthropic, PBC | AI-generated recommendation text, grounded in scores we compute; never used to compute scores or value estimates | Anonymized metric summaries used to draft explanatory text | United States (Standard Contractual Clauses) | Always active |
Execution work adds no sub-processor
Kompena's core analysis and recommendations require nobody outside this register, and neither does execution. When you add an execution retainer, the work is delivered by Kompena itself: no further party is engaged, and none is added here. We do not use an execution partner network.
Execution does mean we need access to the systems a task touches (for example, storefront theme access for a landing-page build, or ad-account access for a campaign fix). That access is requested per task through the in-product access-request flow, is scoped to what the task requires, is time-limited, and is logged. Completing or revoking the task ends it.
Notice of changes
We notify customers by email of any new sub-processor at least 14 days before it begins processing personal data, and update this page at the same time. If you object to a new sub-processor on reasonable data-protection grounds, contact legal@kompena.com within that notice period.