We add a subprocessor only after a documented vendor risk review and DPA execution. Material additions get 30 days advance notice.
Active subprocessors
| Vendor | Purpose | Region | DPA | SOC 2 / Cert |
|---|---|---|---|---|
| Vercel Inc. | Static + serverless hosting | US (multi) | ✓ | SOC 2 Type II |
| GitHub (Microsoft) | Source control · CI/CD | US | ✓ | SOC 2 Type II |
| Stripe Inc. | Payments · subscription billing | US/EU | ✓ | SOC 2 Type II + PCI-DSS L1 |
| n8n (self-hosted) | Workflow automation | self-operated | n/a (we operate) | n/a |
| Email provider (Postmark/Resend) | Transactional + marketing email | US | ✓ | SOC 2 Type II |
| Calendly | Scheduling | US | ✓ | SOC 2 Type II |
| Anthropic (Claude API) | LLM inference (no member PII) | US | ✓ | SOC 2 Type I (Type II pending) |
Subscribe to updates
Email privacy@valuetovictory.com.