Subprocessors
Last updated: October 2026
Watchdog uses the following subprocessors to deliver its services. Processing locations are listed below for each direct subprocessor. Each receives only the minimum data necessary to perform their function.
| Company | Purpose | Data Handled | Processing Location | Persistence |
|---|---|---|---|---|
| Supabase (AWS) | Database | All structured application data | Stockholm, Sweden (eu-north-1) | Persistent |
| Cloudflare | API hosting, AI agent runtime, document storage (R2), AI gateway, email | All API traffic; documents; AI requests; emails, if email features are enabled | EU jurisdiction for stored data. API: Stockholm. Traffic and email pass through Cloudflare's global network | Documents persistent. Agent state up to 7 days. Received emails until processed, at most 30 days. Logs hold metadata only, kept for a limited rolling period |
| Google Cloud (Vertex AI) | AI analysis and search indexing | Invoice and agreement text | Google's global infrastructure, in memory only | Zero data retention: nothing stored; never used for training |
| Amazon Web Services (Bedrock) | AI classification and extraction | Invoice and agreement text | AWS global infrastructure, in memory only | Nothing stored; never used for training |
| Datalab | Document conversion & OCR | Documents and extracted text | Netherlands (EU processing) | Temporary |
| Turbopuffer | Vector search for agreements | Agreement text chunks and embeddings | Frankfurt (eu-central-1) | Persistent |
| Vercel | Web application hosting | User sessions, application traffic | Stockholm (eu-north-1) & Frankfurt (eu-central-1) | Transient |
| Clerk | Authentication, MFA & SSO | Names, email addresses, organization membership, sessions | United States (SCCs / DPF) | Persistent |
| Trigger.dev | Background jobs | Job IDs, status and run logs. Emailed invoices: sender, recipients, subject and file names | Processing: EU. Storage: United States (SCCs) | Runs 14 days, logs 30 days |
| Exa | Web search during AI analysis | Search queries only (no documents) | United States | Per Exa's retention policy |
| Better Stack | Logs & error tracking | Operational logs, errors, and identifiers | Germany (EU region) | Logs 30 days, errors 90 days |
| Slack | Customer community & support communication | Support messages | EU | Persistent |
Primary data storage is in the EU. AI analysis is stateless: Google Cloud and Amazon Web Services process each request in memory and store nothing, which lets us use their full global capacity for the newest models and fast, reliable analysis. The API runs in Stockholm and is reached through Cloudflare's global network, which connects each user through the nearest data centre without storing anything. Clerk (authentication data) and Exa (search queries) process data in the United States. Trigger.dev processes data in the EU but stores it in the United States. These transfers are covered by the safeguards described below and in our Data Processing Agreement.
Legal Entities
The following table provides registered entity details for each subprocessor, as referenced by our Data Processing Agreement.
| Company | Legal Entity | Registration | Address |
|---|---|---|---|
| Supabase | Supabase, Inc | - | 3500 S Dupont Hwy, Camden, DE, USA |
| Cloudflare | Cloudflare, Inc. | - | 101 Townsend Street, San Francisco, CA 94107, USA |
| Google Cloud | Google Cloud EMEA Limited | IE3668997OH | Gordon House 4, Barrow St, Grand Canal Dock, Dublin, Ireland |
| Amazon Web Services | Amazon Web Services EMEA SARL | - | 38 Avenue John F. Kennedy, L-1855 Luxembourg |
| Datalab | Endless Labs, Inc. dba Datalab | - | 228 Park Ave. S PMB 3336.31, New York, NY 10003-1502, USA |
| Turbopuffer | Turbopuffer Inc. | - | 3 Eccles St, Suite 100, Ottawa, ON, Canada |
| Vercel | Vercel UK Ltd | 15286209 (UK Company No) | 4th Floor, St. James House, St. James Square, Cheltenham, GL50 3PR, UK |
| Clerk | Clerk, Inc. (processor) | - | 660 King Street Unit 345, San Francisco, CA 94107, USA. EU representative (Art. 27): VeraSafe Ireland Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, Ireland |
| Trigger.dev | API Hero Ltd | 14441978 (UK Company No) | 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT |
| Exa | Exa Labs Inc. | - | 430 Shotwell Street, San Francisco, CA 94110, USA |
| Better Stack | Better Stack, Inc. | - | 651 N Broad Street, Suite 206, Middletown, DE 19709, USA |
| Slack | Slack Technologies, LLC | - | Salesforce Tower, 415 Mission St, San Francisco, CA 94105, USA |
Third-Party Sub-Processors
Several of our providers use their own sub-processors that in some cases process data outside the EU/EEA — including Clerk's authentication sub-processors, certain hosting log-monitoring providers, and Better Stack's disclosed US/global subprocessors. Such transfers occur in accordance with GDPR Chapter V, using applicable adequacy decisions, the EU-US Data Privacy Framework (DPF), and/or the EU's Standard Contractual Clauses (SCCs), with sufficient technical and organizational measures in place to ensure confidentiality and integrity.
A complete and updated list of the sub-processors used by each provider is available via their websites.
Other Tools
Watchdog runs its internal compliance monitoring (access configurations, policy acknowledgments, evidence for our controls) on a compliance platform it hosts itself. That platform does not receive, process, or store customer personal data, so the providers it runs on are not classified as subprocessors.
Changes to This List
We maintain Data Processing Agreements (DPAs) with all subprocessors. Changes to subprocessors are communicated to customers at least 7 days in advance, in accordance with our Data Processing Agreement.
For questions about our subprocessors, contact hello@watchdog.no.