ConsentStack processes Consent Data in the United States. Transfers from the European Economic Area, the United Kingdom, or Switzerland are covered by the Standard Contractual Clauses in section 13 of our Data Processing Agreement.
ConsentStack uses the following sub-processors to provide our services. We notify customers at least 30 days before adding a new sub-processor, in accordance with the same agreement.
| Sub-Processor | Function | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Supabase | Database & authentication | Consent records, user accounts, site configurations | US (AWS us-east-1) | View |
| Cloudflare | CDN, DNS, edge security, rate limiting | IP addresses (transit only), request headers | Global edge network | View |
| Vercel | Application hosting | Application logs, request metadata | US | View |
| Vercel AI Gateway | AI model routing for scan summaries and report chat | Compliance scan results, chat messages typed into scan reports | US | View |
| Anthropic | AI model provider for scan summaries and report chat | Compliance scan results, chat messages typed into scan reports | US | View |
| Stripe | Payment processing | Billing details, email addresses | US | View |
| Resend | Transactional email | Email addresses, notification content | US | View |
| DeepL | Translation | Consent banner text (no personally identifiable information) | EU (Germany) | View |
| Sanity | Content management | Marketing site content (no personally identifiable information) | US / EU | View |
Last updated: July 31, 2026