porchlightSubprocessors
Last updated: October 5, 2026
The vendors below process personal data on our behalf to deliver Porchlight. We update this list when we add or remove a subprocessor. Processing depends on the features and vendors configured for the account. Recovery imports retain customer-provided evidence; this does not mean every imported record is sent to an AI provider. Stripe supports existing billing arrangements; this list does not enable new purchasing or change existing customer agreements.
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Supabase | Primary database, authentication, object storage | United States | Account data, conversations, imported source evidence, reviewed project and quote context, contacts, message approvals, campaign schedules, replies, delivery events, consent and suppression records |
| Vercel | Application hosting and edge runtime | United States | Request logs, server-rendered responses |
| Anthropic | AI onboarding, preview and business-content drafting | United States | Onboarding and preview conversations, business and website context, content-drafting inputs |
| OpenAI | LLM inference for the live intake agent and structured extraction | United States | Conversation transcripts, relevant business and project context, qualification inputs |
| Twilio | SMS delivery and inbound webhooks | United States | Phone numbers, message bodies, delivery metadata |
| Stripe | Subscription billing and payment processing | United States | Billing email, card brand and last 4, subscription state |
| Resend | Outbound and inbound email: service notifications, quote emails, customer-controlled recovery outreach and replies | United States | Sender and recipient addresses, subjects, message bodies and reply content, headers, delivery metadata and routing tags |
| Sentry | Error monitoring and alerting | United States / European Union | Stack traces, request metadata, org and conversation tags |
| PostHog | Product usage analytics and optional public website analytics, where configured | United States or European Union (configured cloud region) | Usage and interaction events, event properties, browser/device metadata and technical identifiers; public website events require the website analytics preference to be enabled |
| Upstash | Rate limiting and idempotency state | United States | IP and phone keys, message IDs (no message content) |
Subscribe to subprocessor updates by emailing hello@cymbalabs.com.