Sub-processors · v1.0 · 29 June 2026
Sub-processors
These are the third parties Far & Wide uses to operate the platform. Each row names the data they touch, where, and the legal mechanism we rely on for any transfer outside the EEA. We email enterprise account holders before adding a new sub-processor.
| Sub-processor | Role | Location | Transfer mechanism | Data processed |
|---|---|---|---|---|
| Vercel, Inc. | Hosting the marketing site + portal + API routes | EU regions (Frankfurt) + global edge | DPF + SCCs | Account session cookies; HTTP request logs |
| Supabase Inc. | Database, auth, file storage, realtime | EU region (eu-central-1, Frankfurt) | DPF + SCCs (US parent) | Account email, password hash, brand profiles, runs, artifacts, audit log |
| Hetzner Online GmbH | Compute server that runs the audits | Germany (Falkenstein or Nuremberg) | EU/EEA — no transfer outside | Audit progress state; per-client audit configuration; browser session data used for consumer-tier testing |
| Stripe Payments Europe Ltd | Payment processing | Ireland + US | DPF + SCCs | Email, card brand + last 4, billing address; never full card numbers |
| Resend, Inc. | Transactional email delivery (SMTP for Supabase Auth + future transactional) | US | SCCs | Recipient email, message content (sign-in links, password resets) |
| Anthropic PBC | Claude family (audit query generation, verification, framing classification, hallucination detection, synthesis) | US | SCCs (DPA enterprise subscription) | Query text, brand profile facts, AI engine answer snippets — never customer PII |
| OpenAI, OpCo, LLC | gpt-5 (Responses API + web_search) — Tier 1 measurement engine | US | DPF + SCCs | Query text + locale hint + system prompt; AI answer + citations |
| Google LLC (Gemini / Vertex AI) | Gemini grounding — Tier 1 measurement engine | US | DPF + SCCs | Query text + geo hint + system prompt; AI answer + citations |
| Perplexity AI, Inc. | Sonar — Tier 1 measurement engine | US | SCCs | Query text + user_location; AI answer + citations |
| SerpApi LLC | Google AI Overviews (Tier 2 SERP measurement) | US | SCCs | Query text + geo + language; SERP response including AIO block |
| Plausible Insights OÜ | Privacy-friendly web analytics (no cookies, no PII) | Estonia (EU) | EU/EEA — no transfer outside | Page URL, referrer, country (from IP, then discarded), device class |
Notes
- DPF = EU-US Data Privacy Framework (the post-Schrems II adequacy mechanism for certified US recipients).
- SCCs = Standard Contractual Clauses (European Commission Decision 2021/914).
- Each US sub-processor has been assessed for surveillance-law risk under our Transfer Impact Assessment, available on request.
- What never reaches a sub-processor: personal data about your customers. The audit processes public web content + AI engine outputs. PII about your customers should never be entered in a brand profile or query prompt.
Questions: privacy@farandwide.io. To receive sub-processor change notifications, set up an enterprise account with billing contact email.