Sub-processors
Last updated 1 October 2026.
1. Who they are
Supabase. Database, file storage and sign-in. Your documents and their audit trails live here.
Where: London, AWS eu-west-2.
Vercel. Runs the application itself. Handles requests and keeps short-lived request logs; stores none of your documents. Also counts page views on this website with Web Analytics, which sets no cookies and never runs in the app or on signing pages.
Where: Requests served from the London region.
Resend. Sends signature requests, reminders and completion emails, and tells us when one bounces.
Where: United States.
Cloudflare. The anti-bot check on the sign-in page only. A signer never loads it.
Where: United States, served globally.
Stripe. Takes payment for Pro, through its own checkout and billing pages. Card details go straight to Stripe and never reach us. Under Stripe’s Services Agreement, a UK business contracts with Stripe Payments UK Ltd and Stripe Payments Europe, Limited.
Where: United Kingdom and Ireland. Card data may also be processed by Stripe, LLC in the United States, under Stripe’s Data Processing Agreement and its Data Transfers Addendum.
Terms: Stripe Services Agreement and Stripe Data Processing Agreement.
Google Workspace. Our own mailboxes, including info@tryparaph.com, where the contact and feedback forms arrive. Only reaches your data if you write to us.
Where: United States and Europe.
2. What is deliberately not here
No analytics in the product, no error tracker with access to request data, no customer messaging widget and no third-party document scanner. The first-page check on the privacy page runs in our own code, because sending your contracts to an outside service to be classified would be a worse trade than the abuse it prevents.
3. Changes
If we add a sub-processor, we update this page before it touches your data, and we email account owners if the change affects them.