Legal
Plain terms, and your data stays yours.
Four documents govern how Facilitate works with you. Pick one to see what it promises and how it is organized.
Who else handles your data
Facilitate engages a small set of third-party service providers to deliver the platform. We list each one here so you always know who else may process data you share with us, what they do, and where your data sits.
Last updated: 2026-11-01
Each subprocessor below has a current SOC 2 Type 2 attestation, an ISO 27001 certification, or both. We sign Data Processing Agreements with every subprocessor whose terms are no less protective than the ones we offer our own customers.
When we add or replace a subprocessor, customers under an active Data Processing Agreement receive at least 30 days’ notice and have the right to object. Updates to this list are tracked in git so the history is auditable.
Sub-subprocessors
Several of the subprocessors above themselves rely on well-known infrastructure providers. We surface these for transparency:
AWS
Microsoft Azure
Google Cloud
Cloudflare
Questions about our subprocessors?
The providers
Vercel Vercel Inc.
- Service
- Application hosting, edge network, content delivery
- Data processed
- All platform traffic transits Vercel edge; serverless functions execute in Vercel's infrastructure.
- Region
- US East (iad1) primary; multi-region edge
- Compliance
- SOC 2 Type 2, ISO 27001, ISO 27018, PCI DSS L1
Supabase Supabase Inc.
- Service
- Postgres database, authentication, file storage, realtime
- Data processed
- All application data, user accounts, and persisted media (private storage buckets).
- Region
- AWS us-east-1
- Compliance
- SOC 2 Type 2, HIPAA-eligible (Team plan)
Anthropic Anthropic PBC
- Service
- Claude AI text generation (via Vercel AI Gateway)
- Data processed
- AI prompts containing aggregated platform context; AI completions returned.
- Region
- US
- Compliance
- SOC 2 Type 2, ISO 27001, ISO 42001
OpenAI OpenAI, L.L.C.
- Service
- GPT text generation (via Vercel AI Gateway)
- Data processed
- AI prompts and completions, same shape as Anthropic.
- Region
- US
- Compliance
- SOC 2 Type 2, ISO 27001, ISO 27018, ISO 27701
Google Google LLC
- Service
- Gemini text generation (via Vercel AI Gateway) and Gemini image generation
- Data processed
- Text prompts and completions for Gemini; image-generation prompts for Gemini image generation.
- Region
- Google Cloud US
- Compliance
- SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, FedRAMP High
Modal Modal Labs, Inc.
- Service
- Hosting for Facilitate's own open-weight models (message routing and text embeddings)
- Data processed
- Text a user writes, sent to sort a message to the right coaching step and to index the user's own content for search. Results returned. No outside model provider sees this text; Modal runs the models and does not keep the text after each request.
- Region
- US
- Compliance
- SOC 2 Type 2
Resend Resend, Inc.
- Service
- Transactional email delivery
- Data processed
- Recipient email addresses, email subject lines, and email body content (including magic-link tokens, invite tokens, and user-facing PII).
- Region
- US
- Compliance
- SOC 2 Type 2
Sentry Functional Software, Inc., d.b.a. Sentry
- Service
- Error tracking and performance monitoring
- Data processed
- Exception stack traces, request URLs, user IDs, structured tags, debug context. Sensitive parameters scrubbed at capture.
- Region
- US
- Compliance
- SOC 2 Type 2, ISO 27001
Upstash Upstash, Inc.
- Service
- Redis-based rate limiting
- Data processed
- Rate-limit keys (user IDs / IP addresses). Transient TTLs from 60s to 24h. No PII in key payloads.
- Region
- US
- Compliance
- SOC 2 Type 2
GitHub GitHub, Inc. (Microsoft subsidiary)
- Service
- Source code hosting, continuous integration, dependency scanning, code scanning
- Data processed
- Source code, issue and PR metadata, build logs. No production customer data is committed to source control.
- Region
- Multi-region (Microsoft Azure)
- Compliance
- SOC 1 Type 2, SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018