// legal
being finalizedData processing addendum
Where a build touches client data, Sponte acts as a sub-processor under a clear DPA. The formal addendum text is being finalized with counsel; the sub-processor list below is current and complete.
The design intent is plain: strict controls on every build. RLS tenant isolation, vaulted secrets, and an append-only audit trail mean one client's data never bleeds into another's. The DPA documents that split of responsibility in full.
// sub-processors
| provider | purpose | region |
|---|---|---|
| Vercel | Hosting + edge delivery for the build | Configurable region |
| Supabase | Postgres database + auth, with RLS | Your project's region |
| Anthropic / OpenAI | Model inference, the reasoning step only | US / EU |
| Sentry | Error + uptime monitoring, PII scrubbed | EU option |
This list is short by design: most third parties never touch the data path at all. Changes to it are announced before they take effect.
questions before this is published? reach us at hello@sponte.io.