ConsentStack stores Consent Data in the United States. Cloudflare receives consent records at the edge and holds them for a few seconds, in a data center whose location is not fixed, before they are written to our database. Transfers from the European Economic Area, the United Kingdom, or Switzerland are covered by the Standard Contractual Clauses in section 13 of our Data Processing Agreement.
ConsentStack uses the following sub-processors to provide our services. We notify customers at least 30 days before adding a new sub-processor, in accordance with the same agreement. Some of the providers below never receive personal data about your visitors; the Data Processed column says what each one handles.
| Sub-Processor | Function | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Supabase | Database & authentication | Consent records, tracker detection data, hashed visitor IDs for visitor counts, user accounts, site configurations, scan results | US (AWS us-east-1) | View |
| Cloudflare | CDN, DNS, edge security, rate limiting; storage and delivery of the SDK, banner configurations and hosted policies; short-term buffering of consent records and visitor counts; compliance scanner | IP addresses (in transit, not stored), request headers, consent records and hashed visitor IDs (held for seconds before they reach the database), banner configurations, hosted policies | Global edge network | View |
| Vercel | Application hosting | Application logs, request metadata | US | View |
| DigitalOcean | Servers that run compliance scans | Pages of the websites being scanned and the scan results (no visitor data) | US and EU (Germany) | View |
| Vercel AI Gateway | AI model routing for scan summaries and report chat | Compliance scan results, chat messages typed into scan reports | US | View |
| Anthropic | AI model provider for scan summaries and report chat | Compliance scan results, chat messages typed into scan reports | US | View |
| Stripe | Payment processing and billing; partner commission payouts (Stripe Connect) | Billing details, email addresses; partner identity and payout details | US | View |
| Resend | Transactional email | Email addresses, notification content | US | View |
| DeepL | Translation | Consent banner text (no personally identifiable information) | EU (Germany) | View |
| Sanity | Content management | Marketing site content (no personally identifiable information) | US / EU | View |
Last updated: October 21, 2026