Data protection
This page describes the subprocessor categories MatchAudit may use to provide, secure, maintain, and support the service. This list is updated when subprocessors change. Customers may object to a materially new subprocessor within 30 days of notice, as described in the Data Processing Addendum.
Effective date: August 29, 2026
MatchAudit resolves submitted IP addresses locally using cached MaxMind GeoLite2 data and resolves country names locally. Subject IP addresses and free-text locations are not sent to public IP or geocoding APIs.
| Subprocessor | Category | Purpose | Processing location |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Cloud hosting, database, authentication | Hosting, PostgreSQL database, private evidence-file storage, authentication, logs, and newsletter consent records | EU (eu-west-1, Ireland) |
| Stripe (Stripe Payments Europe, Ltd.) | Payment processing | Checkout, subscription administration, invoices, and payment status | EU/US (SCCs apply) |
| Microsoft 365 / Exchange Online (Microsoft Ireland Operations Limited) | Email and support tooling | Business email, support correspondence, and customer communications | EU/EEA tenant where configured; limited global support transfers may apply |
| Resend (Resend, Inc.) | Transactional email delivery | Application-generated email, service notifications, continuity fallback for same-origin contact forms, and newsletter double-opt-in messages | US (SCCs apply) |
| Cloudmersive (Cloudmersive, LLC) | Document malware scanning | Fail-closed security inspection before uploaded evidence is released for document analysis | US and other configured regions (SCCs/model clauses apply) |
| OpenAI (OpenAI Ireland Ltd.) | AI processing | Document transcription, evidence classification, cited field extraction, reviewer assistance, and rationale drafting where AI is enabled | Global, including EU/US (SCCs apply where required) |
| Google Analytics (Google Ireland Limited) | Website analytics | Consent-based measurement of public and customer-facing page usage, including page paths, referrers, device and network data, and pseudonymous identifiers | Global, including EU/US (SCCs apply where required) |
| Vercel (Vercel Inc.) | Application hosting and delivery | Application hosting, server-side request processing, content delivery, and operational logs | Global, primarily US (SCCs apply where required) |
| Fly.io (Fly.io, Inc.) | Shopify application hosting | Hosting the Shopify app web service and background worker, including request processing, session data, and operational logs | EU (Frankfurt, Germany); limited global processing under the DPA and applicable transfer safeguards |
Where personal data is transferred outside the EEA, MatchAudit uses appropriate transfer mechanisms where required, such as adequacy decisions, standard contractual clauses, or equivalent safeguards.
Customers may object to a materially new subprocessor on documented data-protection grounds as described in the Data Processing Addendum.