Subprocessors.
Effective: 20 September 2026
Confir engages a small set of carefully selected third-party subprocessors to help us provide and operate the Service. This page lists each subprocessor, the purpose of the engagement, the categories of personal data involved and the location of processing.
For the contractual obligations governing our use of subprocessors, see our Data Processing Agreement.
The table covers both the application at app.confir.eu, where Customer Data is processed, and this public marketing website at confir.eu. Where a provider is used by only one of the two, the purpose column says so.
Current subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. (USA) | The entire application backend: Postgres database, row-level security, authentication, file storage and Edge Functions. Also sends transactional authentication email (sign-in links, password resets, invitations) through its built-in sender. | All Customer Data — account and authentication data, AI system records, assessments, evidence files, audit logs | Frankfurt, Germany (EU region) |
| Amazon Web Services EMEA SARL (Luxembourg) | Underlying cloud infrastructure for the Supabase projects (compute, storage, network). Engaged by Supabase, not directly by Confir. | All Customer Data — encrypted at rest and in transit | Frankfurt, Germany (eu-central-1) |
| Vercel Inc. (USA) | Hosting, CDN and deployment for the application and for this marketing website | Request metadata — IP address, user agent, requested URL. The application is a static client that talks to Supabase directly, so no Customer Data is stored here. | EEA edge regions; US-incorporated |
| Stripe Payments Europe Ltd (Ireland) | Subscription billing — checkout, customer portal and billing webhooks | Billing contact, company name, VAT ID, payment method tokens (we do not store card numbers) | Dublin, Ireland (EU) |
| Cloudflare, Inc. (USA) | Turnstile — bot protection on the application's sign-in, sign-up and password-reset forms | IP address, user agent and browser-signal telemetry at the moment of the challenge | Global edge network; US-incorporated |
| Google Ireland Limited | Google Analytics 4 — website analytics on this marketing site: which pages are read, which marketing campaigns bring visitors here, and which calls to action are followed. Loaded only after a visitor accepts analytics in the cookie banner, and never in the application. Google Signals, advertising features and ad personalisation are switched off. | Pages viewed, referrer and campaign parameters, approximate location, device and browser type, which calls to action were clicked, and that the contact form was submitted — never what the enquiry was about or anything typed into it. Google Analytics 4 does not log or store IP addresses. No Customer Data. | EU collection endpoints; Google Ireland Limited (Dublin) |
| Google Ireland Limited | Google Fonts — delivery of the Inter webfont used in the application interface. Not used on this marketing website, which self-hosts its fonts. | IP address and user agent, sent by the browser when it requests the font files | Global CDN |
A note on Google Fonts. Analytics is loaded only after a visitor has accepted it. The webfont is not: it is the one provider in this list that a user's browser contacts without being asked and without it being strictly necessary — the font could equally be served from our own domain, as it already is for PDF exports and on this website. We list it here rather than leave it unmentioned, and we intend to self-host it in the application interface as well.
What we do not use
The list above is the whole list. Confir uses no product analytics inside the application, no advertising or retargeting pixels, no session recording, no third-party support-desk software and no third-party CRM or data-enrichment service. The only third-party script this marketing website loads is Google Analytics 4, and only for visitors who have accepted it — a visitor who declines, ignores the banner, or sends a Global Privacy Control signal contacts no third party from this site at all.
Notification of changes
We notify customers at least 30 days in advance of any addition or replacement of a subprocessor. To be notified, email privacy@confir.eu and we will add you to the notification list. Customers may object on reasonable grounds; if we cannot accommodate the objection, the affected services may be terminated without penalty.
Affiliates
Confir has no affiliates as of the effective date of this page. If we engage affiliates to provide the Service in the future, they will be bound by the same data-protection terms as third-party subprocessors and will be listed in the table above.
Contact
Questions about our subprocessors? Write to privacy@confir.eu.