Subprocessors
Version 1.1, in force from 29 October 2026 for pilot customers (version 1: 26 October 2026). Not yet reviewed by a lawyer; wording may change before general release.
The companies that process data for us when we provide Doppelgone for Work. This list is Annex 3 of the Data processing agreement. We email the account owner at least 30 days before adding or replacing a subprocessor that processes personal information on your behalf.
The list
| Subprocessor | What it does for us | What it sees | Region | Their data terms |
|---|---|---|---|---|
| Vercel Inc. | Hosts the application and runs its functions | Everything the application handles while running: metadata, hashes, groups, account data, request logs (no file names in logs) | Functions in the EU (Dublin); US company, global edge network | vercel.com/legal/dpa |
| Supabase Inc. | Managed Postgres database | Everything we store: metadata, hashes, groups, actions, audit log, account and billing data. No file contents. | EU (Ireland, AWS eu-west-1) | supabase.com/legal/dpa |
| TypeSafe | AI judgments on whether two documents are the same | Short text excerpts and coarse facts about candidate documents. No file names, paths, owners or tenant identifiers. | United States. Kept only as long as needed to answer, under its privacy policy; never used to train or fine-tune its models | Privacy policy: typesafe.ai/privacy |
| Polar Software Inc. | Checkout, invoices and VAT as merchant of record (for payment it acts as the seller under its own terms) | Billing details you enter at checkout, your organisation id, order and refund records. No file data. | USA / EU | polar.sh/legal/privacy |
| Resend | Sends our emails (invites, reports, notices) | Recipient name and email, the content of the email (never file names or file data) | USA |
Only Vercel, Supabase and TypeSafe see file data. Polar and Resend see account data only. resend.com/legal/dpa | | Microsoft Corporation | Your own Microsoft 365 tenant, where your files live, and sign-in | Your files, as it already does. We read through Microsoft Graph with the permissions your admin consented to. | Your tenant's region | Your existing Microsoft agreement; not our subprocessor in the usual sense | | Google LLC (later) | Google Drive, when supported | As Microsoft, for Google Workspace tenants | Your tenant's region | Your existing Google agreement |
Notes
- No Upstash, no Redis. An earlier plan used Upstash; it was dropped. Rate limits and caches live in Postgres.
- Vercel region. Functions run in the EU (Dublin). We may add a Cape Town region for South African residency as an Enterprise option.
- Transfers. Vercel, Polar and Resend are US companies. Each publishes a DPA with Standard Contractual Clauses (or equivalent), which we rely on for POPIA section 72 and the GDPR's transfer rules. Supabase processes in the EU. TypeSafe processes in the United States under its published privacy policy; what it receives carries no file names, owners or tenant identifiers.
- Our own access. The operator (Juan Hamman, founder) is not a subprocessor but has production access from South Africa for support and incidents, logged, with MFA. See the Security sheet.
- Questions: work@doppelgone.app.
Computron Tech (Pty) Ltd, trading as Doppelgone. Last reviewed: 29 Oct 2026.