Subprocessors
Last updated: May 2026
Watchdog uses the following subprocessors to deliver its services. Processing locations are listed below for each direct subprocessor. Each receives only the minimum data necessary to perform their function.
| Company | Purpose | Data Handled | Processing Location |
|---|---|---|---|
| Supabase | Database & file storage | All application data, documents | Stockholm, Sweden (eu-north-1) |
| Google Cloud (Vertex AI) | AI compliance analysis | Invoice and agreement text (not persisted) | Belgium (europe-west1) |
| Vercel | Application hosting | Application code, user sessions | Stockholm (eu-north-1) & Frankfurt (eu-central-1) |
| Clerk | Authentication & SSO | User identity, sessions | EU |
| Trigger.dev | Background task orchestration | Task metadata and job IDs | EU |
| Turbopuffer | Vector search | Agreement text chunks and embeddings | Frankfurt (eu-central-1) |
| Datalab | Document conversion & OCR | Text documents and extracted text (conversion results are deleted at most one hour after processing completes) | United States |
| Slack | Customer community & support communication | Community messages, support context, and files voluntarily shared in Slack channels | EU |
| PostHog | Product analytics & error tracking | Usage events and error tracking (no business data). With cookie consent: IP address and email | EU |
Legal Entities
The following table provides registered entity details for each subprocessor, as referenced by our Data Processing Agreement.
| Company | Legal Entity | Registration | Address |
|---|---|---|---|
| Supabase | Supabase, Inc | - | 3500 S Dupont Hwy, Camden, DE, USA |
| Google Cloud | Google Cloud EMEA Limited | IE3668997OH | Gordon House 4, Barrow St, Grand Canal Dock, Dublin, Ireland |
| Vercel | Vercel UK Ltd | 15286209 (UK Company No) | 4th Floor, St. James House, St. James Square, Cheltenham, GL50 3PR, UK |
| Clerk | VeraSafe Ireland Ltd | - | Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, Ireland |
| Turbopuffer | Turbopuffer Inc. | - | 3 Eccles St, Suite 100, Ottawa, ON, Canada |
| Trigger.dev | API Hero Ltd | 14441978 (UK Company No) | 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT |
| Slack | Slack Technologies, LLC | - | Salesforce Tower, 415 Mission St, San Francisco, CA 94105, USA |
| PostHog | PostHog, Inc. | - | 2261 Market St #4008, San Francisco, CA 94114, USA |
| Datalab | Endless Labs, Inc. dba Datalab | - | 228 Park Ave. S PMB 3336.31, New York, NY 10003-1502, USA |
Third-Party Sub-Processors
Some providers such as Supabase, Google, and Datalab use their own sub-processors that in some cases may process data outside the EU/EEA. Such transfers occur in accordance with GDPR Chapter V, using the EU's Standard Contractual Clauses (SCCs), and with sufficient technical and organizational measures in place to ensure confidentiality and integrity.
A complete and updated list of sub-processors used by Supabase, Google, and Datalab is available via their websites.
Other Tools
Watchdog uses Drata for internal compliance monitoring (endpoint protection, access configurations, policy acknowledgments). Drata does not receive, process, or store customer personal data and is therefore not classified as a subprocessor.
Changes to This List
We maintain Data Processing Agreements (DPAs) with all subprocessors. Changes to subprocessors are communicated to customers at least 7 days in advance, in accordance with our Data Processing Agreement.
For questions about our subprocessors, contact hello@watchdog.no.