Subprocessors
Last updated: August 2026
Watchdog uses the following subprocessors to deliver its services. Processing locations are listed below for each direct subprocessor. Each receives only the minimum data necessary to perform their function.
| Company | Purpose | Data Handled | Processing Location |
|---|---|---|---|
| Supabase | Database & file storage | All application data, documents | Stockholm, Sweden (eu-north-1) |
| Google Cloud (Vertex AI) | AI compliance analysis | Invoice and agreement text (not persisted) | Belgium (europe-west1) |
| Amazon Bedrock | AI compliance analysis | Invoice and agreement text (not persisted) | EU |
| Vercel | Application hosting | Application code, user sessions | Stockholm (eu-north-1) & Frankfurt (eu-central-1) |
| Clerk | Authentication & SSO | User identity, sessions | United States (SCCs) |
| Trigger.dev | Background task orchestration | Task metadata and job IDs | EU |
| Turbopuffer | Vector search | Agreement text chunks and embeddings | Frankfurt (eu-central-1) |
| Datalab | Document conversion & OCR | Text documents and extracted text (conversion results are deleted at most one hour after processing completes) | Netherlands |
| Slack | Customer community & support communication | Community messages, support context, and files voluntarily shared in Slack channels | EU |
| Better Stack | Production application error tracking | Exception stacks, release identifiers, uploaded JavaScript/TypeScript source maps, and relevant operational metadata, which may include organization names/IDs, entity IDs, and invoice, agreement, alert, supplier, amount, currency, date, status, provider, request/run, and filename fields. Credentials, raw documents/payloads, payment or national identifiers, and AI prompts/outputs are excluded. Error data and source maps follow the configured monitoring retention and account-deletion process | Germany (primary error-data and source-map region); Better Stack and its disclosed subprocessors may process or access data from the United States and other locations under applicable safeguards |
Legal Entities
The following table provides registered entity details for each subprocessor, as referenced by our Data Processing Agreement.
| Company | Legal Entity | Registration | Address |
|---|---|---|---|
| Supabase | Supabase, Inc | - | 3500 S Dupont Hwy, Camden, DE, USA |
| Google Cloud | Google Cloud EMEA Limited | IE3668997OH | Gordon House 4, Barrow St, Grand Canal Dock, Dublin, Ireland |
| Amazon Bedrock | Amazon Web Services EMEA SARL | - | 38 Avenue John F. Kennedy, L-1855 Luxembourg |
| Vercel | Vercel UK Ltd | 15286209 (UK Company No) | 4th Floor, St. James House, St. James Square, Cheltenham, GL50 3PR, UK |
| Clerk | Clerk, Inc. (processor) | - | 660 King Street Unit 345, San Francisco, CA 94107, USA. EU representative (Art. 27): VeraSafe Ireland Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, Ireland |
| Turbopuffer | Turbopuffer Inc. | - | 3 Eccles St, Suite 100, Ottawa, ON, Canada |
| Trigger.dev | API Hero Ltd | 14441978 (UK Company No) | 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT |
| Slack | Slack Technologies, LLC | - | Salesforce Tower, 415 Mission St, San Francisco, CA 94105, USA |
| Better Stack | Better Stack, Inc. | - | 651 N Broad Street, Suite 206, Middletown, DE 19709, USA |
| Datalab | Endless Labs, Inc. dba Datalab | - | 228 Park Ave. S PMB 3336.31, New York, NY 10003-1502, USA |
Third-Party Sub-Processors
Some providers such as Supabase, Google, Datalab, Vercel, Clerk, and Better Stack use their own sub-processors that in some cases process data outside the EU/EEA — including Clerk's authentication sub-processors, certain hosting log-monitoring providers, and Better Stack's disclosed US/global subprocessors. Such transfers occur in accordance with GDPR Chapter V, using applicable adequacy decisions, the EU-US Data Privacy Framework (DPF), and/or the EU's Standard Contractual Clauses (SCCs), with sufficient technical and organizational measures in place to ensure confidentiality and integrity.
A complete and updated list of sub-processors used by Supabase, Google, Datalab, Vercel, Clerk, and Better Stack is available via their websites.
Other Tools
Watchdog uses Drata for internal compliance monitoring (endpoint protection, access configurations, policy acknowledgments). Drata does not receive, process, or store customer personal data and is therefore not classified as a subprocessor.
Changes to This List
We maintain Data Processing Agreements (DPAs) with all subprocessors. Changes to subprocessors are communicated to customers at least 7 days in advance, in accordance with our Data Processing Agreement.
For questions about our subprocessors, contact hello@watchdog.no.