Subprocessors
Last updated: October 23, 2026
These companies process personal data on Ampost's behalf to run the Service. Each one is bound by a data processing agreement with protections at least as strong as those in our Data Processing Addendum. The Privacy Policy explains what we collect and why.
Current subprocessors
| Subprocessor | Purpose | Personal data | Location and transfer safeguard |
|---|---|---|---|
| SupabaseSupabase, Inc. | Application database and authentication (sign-in, sessions) | Everything stored in an Ampost account: account email and profile, posts, connected-account data and encrypted tokens, analytics, API keys (hashed), webhooks, billing references | EU (Frankfurt, Germany, AWS eu-central-1)Hosted in the EU; Standard Contractual Clauses for support access from outside the EU |
| VercelVercel Inc. | Hosting and server functions, media file storage (Vercel Blob), cookieless Web Analytics, request logs | All data in transit through the app, uploaded images and videos, IP address and browser in request logs, aggregate page views | Server functions in the EU (Frankfurt); content delivery and media files through Vercel's worldwide edge networkStandard Contractual Clauses |
| Amazon Web ServicesAmazon Web Services EMEA SARL | Key management (AWS KMS) for the keys that encrypt connected-account tokens | Encryption keys only; no tokens or other personal data are sent to AWS | EU (Frankfurt, Germany, eu-central-1)Not applicable (EU) |
| StripeStripe Payments Europe, Ltd. | Subscription records and the billing portal. Purchases are sold through Link: there Stripe is the merchant of record and processes payment, tax and payment-support data as its own controller (Link Privacy Policy) | Name, email, billing address, payment method, tax ID if given, purchase history | EU (Ireland) and United StatesStandard Contractual Clauses and the EU-US Data Privacy Framework |
| CloudflareCloudflare, Inc. | Turnstile bot check on sign-in, sign-up and password reset | IP address and browser signals during the check | Worldwide edge networkStandard Contractual Clauses and the EU-US Data Privacy Framework |
| ResendResend, Inc. | Delivery of sign-in, confirmation and password-reset emails (SMTP for Supabase Auth) and of account notices, such as the warning before an inactive free account is deleted | Email address and the content of these emails | United StatesStandard Contractual Clauses |
| GoogleGoogle Ireland Limited and Google LLC | Google Analytics 4 on the public website, only with consent. (Sign in with Google is a service you choose; Google acts there as its own controller.) | Pseudonymous browser identifier, pages viewed, browser, device, approximate location | EU and United StatesEU-US Data Privacy Framework and Standard Contractual Clauses |
Not subprocessors
- The social platforms you connect (Instagram, Facebook, LinkedIn, TikTok, Threads, X, Bluesky, Telegram, Discord, YouTube and Pinterest). Ampost sends them your content because you tell it to; each platform processes it under its own terms as an independent controller.
- The endpoints you register for outgoing webhooks and the AI clients you authorize through MCP. They receive data because you configured them.
Changes
We announce a new or replaced subprocessor at least 30 days before it starts processing customer personal data: on this page (the date above changes) and by email to customers who asked for notice. To ask for notice, or to object to a change under the DPA, write to privacy@ampost.io.