Subprocessors.
Effective: 1 November 2026
Confir engages a small set of carefully selected third-party subprocessors to help us provide and operate the Service. This page lists each subprocessor, the purpose of the engagement, the categories of personal data involved and the location of processing.
For the contractual obligations governing our use of subprocessors, see our Data Processing Agreement.
The table covers both the application at app.confir.eu, where Customer Data is processed, and this public marketing website at confir.eu. Where a provider is used by only one of the two, the purpose column says so.
Current subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. (USA) | The entire application backend: Postgres database, row-level security, authentication, file storage and Edge Functions. Its authentication service triggers the transactional account emails (sign-up confirmations, password resets, sign-in links, email-change confirmations and confirmation codes), which are delivered through Resend. | All Customer Data — account and authentication data, AI system records, assessments, evidence files, audit logs | Frankfurt, Germany (EU region) |
| Amazon Web Services EMEA SARL (Luxembourg) | Underlying cloud infrastructure for the Supabase projects (compute, storage, network). Engaged by Supabase, not directly by Confir. | All Customer Data — encrypted at rest and in transit | Frankfurt, Germany (eu-central-1) |
| Vercel Inc. (USA) | Hosting, CDN and deployment for the application and for this marketing website | Request metadata — IP address, user agent, requested URL. The application is a static client that talks to Supabase directly, so no Customer Data is stored here. | EEA edge regions; US-incorporated |
| Stripe Payments Europe Ltd (Ireland) | Subscription billing — checkout, customer portal and billing webhooks | Billing contact, company name, VAT ID, payment method tokens (we do not store card numbers) | Dublin, Ireland (EU) |
| Cloudflare, Inc. (USA) | Turnstile — bot protection on the application's sign-in, sign-up and password-reset forms | IP address, user agent and browser-signal telemetry at the moment of the challenge | Global edge network; US-incorporated |
| Google Ireland Limited | Google Analytics 4 — website analytics on this marketing site: which pages are read, which marketing campaigns bring visitors here, and which calls to action are followed. Loaded only after a visitor accepts analytics in the cookie banner, and never in the application. Google Signals, advertising features and ad personalisation are switched off. | Pages viewed, referrer and campaign parameters, approximate location, device and browser type, which calls to action were clicked, and that the contact form was submitted — never what the enquiry was about or anything typed into it. Google Analytics 4 does not log or store IP addresses. No Customer Data. | EU collection endpoints; Google Ireland Limited (Dublin) |
| Resend (Plus Five Five, Inc., USA) | Email delivery. In the application: the transactional account emails sent from noreply@confir.eu (sign-up confirmations, password resets, sign-in links, email-change confirmations and confirmation codes). On this marketing website: delivery of contact-form messages to our inbox. Emails are sent from AWS eu-west-1 (Ireland); Resend stores email data and logs in the United States and uses Amazon Web Services as a further subprocessor. | Application: the recipient's email address; the content of the email, including its single-use link or confirmation code; and delivery metadata and event logs, which Resend retains for 30 days. Open and click tracking are disabled. Contact form: name, work email, company, role and the content of the message. | United States; EU-U.S. Data Privacy Framework (certified) and EU Standard Contractual Clauses |
Change history
- 1 November 2026 — Resend listed for the application's account emails; it was previously listed for the contact form only.
What we do not use
The list above is the whole list. Confir uses no product analytics inside the application, no advertising or retargeting pixels, no session recording, no third-party support-desk software and no third-party CRM or data-enrichment service. The only third-party script this marketing website loads is Google Analytics 4, and only for visitors who have accepted it — a visitor who declines, ignores the banner, or sends a Global Privacy Control signal contacts no third party from this site at all.
Notification of changes
We notify customers at least 30 days in advance of any addition or replacement of a subprocessor. To be notified, email privacy@confir.eu and we will add you to the notification list. Customers may object on reasonable grounds; if we cannot accommodate the objection, the affected services may be terminated without penalty.
Affiliates
Confir has no affiliates as of the effective date of this page. If we engage affiliates to provide the Service in the future, they will be bound by the same data-protection terms as third-party subprocessors and will be listed in the table above.
Contact
Questions about our subprocessors? Write to privacy@confir.eu.