Subprocessor List
The third-party providers that process customer data on Baseline PCR's behalf, what each does and where it processes data.
Version 1 · effective 2026-09-17
Baseline PCR uses the following subprocessors to provide the Service. Each is bound by a written agreement to process data only on our instructions and to protect it with appropriate security. Customers who have executed the Data Processing Addendum receive thirty days' notice of additions or replacements by email; everyone else can watch this page.
Active subprocessors
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, compute, AI gateway, cookieless web analytics | All Service traffic; evidence in transit to AI models; aggregate page-view data | United States |
| Supabase Inc. | Database and object storage | Account data, jobs, evidence files, reports, audit log | United States |
| Clerk Inc. | Authentication and organization management | Names, emails, sign-in metadata | United States |
| Anthropic PBC | AI models for classification, extraction and drafting (via the Vercel AI Gateway) | Photographs, documents, notes and derived data sent for processing; no training; zero-retention configuration where offered | United States |
| Stripe Inc. | Billing and payments | Billing contact, payment method (we never see card numbers), invoices | United States |
| Resend Inc. | Transactional email | Recipient addresses, report links, attachments you send | United States |
| Inngest Inc. | Background job orchestration | Job and report identifiers, processing progress; no evidence payloads | United States |
| Railway Corp. | Hosting for the PDF rendering service (Gotenberg) | Report HTML and embedded photographs during rendering only; nothing stored | United States |
Providers that do not process customer data
GitHub (source code and continuous integration; no customer data), Porkbun (domain registration), and our email provider for hello@ correspondence (only what you send us).
Material changes
We will update this page and, for DPA customers, send notice before a new subprocessor begins processing customer data.