The providers in the first table process Customer-controlled personal data on our behalf and are authorised as subprocessors under our Data Processing Agreement.
| Provider | Purpose | Primary processing location |
|---|---|---|
| Supabase | Authentication, PostgreSQL database and private file storage | London, United Kingdom (eu-west-2) |
| Railway | Application hosting and infrastructure | Amsterdam, Netherlands (EU West Metal) |
| Postmark (AC PM LLC) | Account and transactional email delivery; message content is retained by Postmark for up to 45 days | United States and other locations used by Postmark and its infrastructure providers |
Other providers used for our own controller processing
| Provider | Purpose | Role and location |
|---|---|---|
| Stripe | Subscription billing, payment processing, regulatory compliance and fraud prevention | Stripe may act as our processor or as an independent controller depending on the activity. Processing may occur in the United Kingdom, EEA and other locations described by Stripe. Payment-card details are collected directly by Stripe and are not stored by One Big Team. |
We will update this page if a provider, purpose, role or relevant location changes. We will give Customers notice before appointing or replacing a subprocessor in accordance with our Data Processing Agreement. A provider will not be described as active until the relevant production integration and contractual safeguards are in place.