Sub-processor list
Last updated 24 July 2026 · Version 0.1 (draft)
A sub-processor is a third party that processes personal data on our behalf to help run the service. CRCX is committed to keeping the core stack in the European Union, with no sub-processor outside the EU.
The table below lists our current sub-processors. It is dated, and we keep it current as the stack changes.
| Name | Function | Location | Data processed |
|---|---|---|---|
| {{TO CONFIRM: Vercel}} | Website and app hosting | {{TO CONFIRM: EU region}} | Technical request data, IP address |
| {{TO CONFIRM: Sanity}} | Content management for site content | {{TO CONFIRM: EU region}} | Published content, editor account data |
| {{TO CONFIRM: Supabase}} | App authentication, database, and webinar registrations | {{TO CONFIRM: EU region, Frankfurt}} | Email, authentication data, product event data, webinar registration details |
| {{TO CONFIRM: email / SMTP provider}} | Transactional and enquiry email | {{TO CONFIRM: EU region}} | Email address, message content |
| {{TO CONFIRM: analytics provider}} | Cookieless website analytics | {{TO CONFIRM: EU region}} | Aggregate, non identifying usage data |
| {{TO CONFIRM: Cal.com}} | Meeting scheduling on the contact page | {{TO CONFIRM: data region}} | Name, email, meeting metadata, IP address |
A note on Cal.com and sovereignty
Cal.com is US based, but it is open source and self hostable. For full sovereignty we could self host it in the EU or use an EU based scheduler. Otherwise we sign Cal.com's DPA, confirm the data region, and disclose it here. Status: {{TO CONFIRM: hosting choice and data region for Cal.com}}.
How we notify changes
When we add or replace a sub-processor, we update this list and its date. Clients under a Data Processing Agreement are notified as that agreement sets out: {{TO CONFIRM: notice period and method}}.
Contact
Questions about our sub-processors can go to hello@crcx.eu.