Sub-processors
Last updated: May 29, 2026
This page lists the third-party vendors Revelica engages to process customer personal data.
We notify customers at least 15 days before adding a new sub-processor that processes customer personal data, with a 10-day objection window for paid customers.
Infrastructure
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| Supabase |
Database (Postgres), authentication, file storage, realtime messaging |
AWS Canada Central (Montreal) — ca-central-1 |
USA |
supabase.com/privacy |
| Vercel |
Application hosting and edge compute for revelica.com and app.revelica.com |
Static and edge: global edge network. Serverless functions: Canada (Montreal, yul1) |
USA |
vercel.com/legal/dpa |
| Fly.io |
Application hosting for the Revelica Python backend, including the product agent's orchestration logic and the MCP server at api.revelica.com/mcp |
Canada (Toronto, yyz) |
USA |
fly.io/legal/privacy-policy |
| Cloudflare |
Domain registration and DNS services for revelica.com and subdomains |
Global edge network |
USA |
cloudflare.com/privacypolicy |
AI & inference
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| Anthropic |
Large language model inference (Claude Sonnet, Claude Opus) for agent reasoning, content generation, and orchestration |
USA |
USA |
anthropic.com/legal/commercial-terms |
| OpenAI |
Large language model inference (GPT models, image generation) for specific agent tasks |
USA |
USA |
openai.com/policies/business-terms |
We have contractual commitments with both Anthropic and OpenAI prohibiting the use of Revelica customer data to train any of their models.
Web search & retrieval
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| Exa |
Web search and content retrieval used by the product agent during customer research, competitive analysis, and market research playbooks |
USA |
USA |
exa.ai/privacy |
Billing
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| Stripe |
Payment processing, subscription management, customer billing portal |
USA (with regional acquiring) |
USA |
stripe.com/privacy |
Communications
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| Resend |
Transactional email delivery (sign-up confirmations, password resets, system notifications) |
USA |
USA |
resend.com/legal/dpa |
| Attio |
Customer Relationship Management for inbound contacts and waitlist subscribers |
EU |
UK |
attio.com/legal/privacy |
Analytics
| Sub-processor |
Purpose |
Region of processing |
HQ |
Reference |
| PostHog |
Product analytics (anonymized usage events, feature engagement). Used only after explicit consent through our cookie banner. |
EU region (PostHog Cloud EU) |
USA |
posthog.com/handbook/company/data-processing |
Notes
- External image proxy: Revelica proxies Google profile pictures, GitHub avatars, and similar public images through
revelica.com/api/v1/images/external to prevent rate limiting. These images are public, are not stored on our infrastructure, and the proxy does not constitute sub-processing.
- Identity providers: Sign-in via Google OAuth is handled through Supabase Auth. Google is the identity provider; we do not directly receive Google account credentials. Google's role is governed by their own privacy policy.
- MCP coding agent traffic: When you use a coding agent (Claude Code, Cursor, etc.) to talk to Revelica's MCP server, your data flows through the AI provider chosen by you, on terms governed by your agreement with that provider. Revelica is not the controller for those upstream interactions; we only see the requests that arrive at our MCP endpoint.
Updates
- Version 1 — initial publication, May 29, 2026
To subscribe to sub-processor change notifications, email privacy@revelica.com.
