Subprocessors and Service Providers

SmartComply uses subprocessors and service providers to operate the service. These providers may process customer data, personal information, account information, logs, support content, billing details, or usage data depending on the service they provide.

Provider use may vary by customer plan, enabled feature, region, integration, consent choices, and deployment configuration.

• Vercel: application hosting, preview deployments, edge delivery, deployment pipeline, analytics, performance insights, and related infrastructure.
• Nile / managed PostgreSQL: tenant-aware database services and managed PostgreSQL infrastructure.
• Google: Google Tag Manager, Google Analytics, advertising or conversion measurement when enabled by consent and tag configuration, and related Google services used for site measurement.
• Stripe: checkout, billing, invoices, subscription management, customer payment portal, and payment processing.
• Anthropic: AI-generated support responses or AI-assisted product features when AI support or AI workflows are enabled.
• Sentry or equivalent diagnostics: error monitoring, performance troubleshooting, diagnostics, and reliability investigation when enabled.
• Email and communications providers: transactional messages, contact requests, account notices, workflow notices, reminders, and product communications when configured.
• Hosting, storage, security, and infrastructure providers: cloud services used to operate, secure, back up, monitor, and deliver SmartComply.
• Customer-configured integrations: LIMS, GIS, utility billing, state reporting, Zapier/Make, webhook endpoints, identity providers, or other systems connected by or for a customer.

We select providers based on the function they perform, the sensitivity of information involved, reliability, security posture, contractual terms, and business need.

Where appropriate, providers are restricted to processing information for the services they provide to SmartComply and are subject to confidentiality, security, or data protection obligations.

Some integrations are enabled, configured, or supplied by the customer. Customers are responsible for the credentials, endpoints, permissions, data mapping, downstream use, and security of customer-controlled integrations.

SmartComply is not responsible for third-party systems that a customer connects to SmartComply or for how those systems process exported or transmitted data.

We may add, remove, or replace subprocessors and service providers as SmartComply evolves. Material changes will be reflected in this legal center, customer agreements, or procurement materials where required.

Enterprise customers that need advance notice, objection rights, region restrictions, or a signed subprocessor exhibit should address those requirements in a written agreement.

Questions about subprocessors may be sent to privacy@smartcomply.app or to the customer’s account contact.