Legal
Subprocessors
Last updated: September 4, 2026
These are the providers we use to run appresta.iq. Each processes data only on our instructions and only to deliver the service. This is the complete list — if we add a provider, we update this page.
| Provider | What it does | What it can see |
|---|---|---|
| Vercel | Application hosting, serverless functions, file storage for report PDFs, and cookieless product analytics. | Everything that passes through the application, and report PDFs at rest. |
| Supabase | Sign-in links and the database holding all Bedrock Discovery data. | Email addresses and session tokens; all Discovery records, including the colleagues your team enters as stakeholders. |
| Airtable | System of record for accounts, seats, assessments, and the product catalog. | Names, email addresses, company, phone number, and assessment answers. |
| Anthropic | Generates the written narrative and tailored plan in your assessment report. | No personal information. Question text, the answers chosen, scores, and a persona label only — no name, email address, or company name, and no Discovery data of any kind. |
| Stripe | Payments and the billing portal. | Billing contact and payment details. Card numbers never reach our servers. |
| Resend | Transactional email: sign-in links, report notifications, roll-call invitations, and deletion receipts. | Recipient email addresses and the contents of those messages. |
| Sentry | Error monitoring. | Error messages and stack traces. Configured to exclude IP addresses, cookies, request bodies, and user records. |
| Upstash | Rate-limit counters and a short-lived cache of generated reports. | Account and user identifiers, and cached report content. |
| Inngest | Runs background jobs: report generation and the nightly benchmark aggregation. | Record identifiers passed between job steps, not record contents. |
| Browserless | Renders your assessment report to PDF. | The contents of the report at the moment it is rendered. |
Where Bedrock Discovery data goes
Your Discovery data — the org structure, the systems inventory, the stakeholder list, the workflow traces — is stored in our Postgres database at Supabase and nowhere else. It is never sent to an AI model, and it is never shared with another customer. Each organization's rows are isolated at the database level, not merely filtered in application code.
An account admin can export all of it, or delete all of it, from the profile page at any time.
What we send to Anthropic
The written narrative and tailored plan in your assessment report are generated by Anthropic's Claude models. What we send is the assessment itself: question text, the answers chosen and how they scored, and the persona lens selected for the report. We do not send your name, your email address, your company name, or any Bedrock Discovery data.
Questions
If your security or procurement team needs more detail, email security@apprestaiq.com and we will send our data-flow summary and answer a questionnaire directly. Our Privacy Policy and Terms cover the rest.