Subprocessors

PRplus engages the following third-party service providers to deliver our product. We require each subprocessor to provide protections at least as strict as our own under their respective data processing agreements.

Last updated: April 22, 2026

Change notifications

We will notify customers of any material change to this list (new subprocessor, region change, or removal) at least 30 days before the change takes effect. Customers with an active DPA can subscribe to change notifications by emailing legal@prplus.io.

Subprocessor	Purpose	Data categories	Region
Supabase Privacy policy	Primary database, authentication, file storage, realtime	All customer content (clients, pitches, reports, team members), auth identities	US (AWS us-east-1)
Vercel Privacy policy	Application hosting, edge network, serverless functions	Request metadata, IP addresses (for abuse prevention), deployment logs	Global (US, EU, APAC edge)
Anthropic Privacy policy	AI model inference (Claude) for pitch writing, agents, reports	Prompt content submitted by users (client context, pitch drafts, agent queries)	US
Stripe Privacy policy	Subscription billing, invoicing, payment processing	Billing email, payment method tokens (never raw card data), invoice history	US / global per Stripe regions
Resend Privacy policy	Transactional email delivery (pitches, notifications, auth emails)	Recipient email addresses, email body content, delivery/open/click events	US
Upstash (Redis) Privacy policy	Rate limiting, short-lived cache, in-memory counters	IP addresses and user IDs for rate-limit keys (24h TTL)	US (Global low-latency replication available)
Sentry Privacy policy	Error tracking, performance monitoring	Error stack traces, request metadata, user ID references (never raw content)	US
PostHog Privacy policy	Product analytics (only when the user accepts the cookie banner)	Anonymous usage events, identified user ID when signed in, feature flag evaluations	US (us.i.posthog.com)

Supabase

Purpose: Primary database, authentication, file storage, realtime
Data categories: All customer content (clients, pitches, reports, team members), auth identities
Region: US (AWS us-east-1)

Vercel

Purpose: Application hosting, edge network, serverless functions
Data categories: Request metadata, IP addresses (for abuse prevention), deployment logs
Region: Global (US, EU, APAC edge)

Anthropic

Purpose: AI model inference (Claude) for pitch writing, agents, reports
Data categories: Prompt content submitted by users (client context, pitch drafts, agent queries)
Region: US

Stripe

Purpose: Subscription billing, invoicing, payment processing
Data categories: Billing email, payment method tokens (never raw card data), invoice history
Region: US / global per Stripe regions

Resend

Purpose: Transactional email delivery (pitches, notifications, auth emails)
Data categories: Recipient email addresses, email body content, delivery/open/click events
Region: US

Upstash (Redis)

Purpose: Rate limiting, short-lived cache, in-memory counters
Data categories: IP addresses and user IDs for rate-limit keys (24h TTL)
Region: US (Global low-latency replication available)

Sentry

Purpose: Error tracking, performance monitoring
Data categories: Error stack traces, request metadata, user ID references (never raw content)
Region: US

PostHog

Purpose: Product analytics (only when the user accepts the cookie banner)
Data categories: Anonymous usage events, identified user ID when signed in, feature flag evaluations
Region: US (us.i.posthog.com)

Questions?

For subprocessor-related questions — including DPA requests, regional hosting options, or SOC 2 status — contact legal@prplus.io.