ConsentStack uses the following sub-processors to provide our services. We notify customers at least 30 days before adding a new sub-processor, in accordance with our Data Processing Agreement.
| Sub-Processor | Function | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Supabase | Database & authentication | Consent records, user accounts, site configurations | US (AWS us-east-1) | View |
| Cloudflare | CDN, DNS, edge security, rate limiting | IP addresses (transit only), request headers | Global edge network | View |
| Vercel | Application hosting | Application logs, request metadata | US | View |
| Stripe | Payment processing | Billing details, email addresses | US | View |
| Resend | Transactional email | Email addresses, notification content | US | View |
| DeepL | Translation | Consent banner text (no personally identifiable information) | EU (Germany) | View |
| Sanity | Content management | Marketing site content (no personally identifiable information) | US / EU | View |
Last updated: March 21, 2026