Sub-processors
Last updated: March 2026
38os uses the following third-party sub-processors to deliver the Service. Each sub-processor has been vetted for its data protection practices, and appropriate Data Processing Agreements are in place with each provider.
| Sub-processor | Purpose | Data Processed | Location | DPA Status |
|---|---|---|---|---|
| Supabase (Supabase Inc.) | Database & Authentication | Account data, business data | USA / Singapore | DPA in place |
| Anthropic | AI Processing | Business context for AI features | USA | DPA in place (API terms) |
| Vercel (Vercel Inc.) | Hosting & CDN | HTTP headers, IP addresses | Global edge | DPA in place |
| Resend (Resend Inc.) | Transactional Email | Email addresses, email content | USA | DPA in place |
| PostHog (PostHog Inc.) | Product Analytics | Anonymous usage data (with consent) | EU / USA | DPA in place |
| Google (Google LLC) | OAuth Authentication | Name, email, profile photo | USA | DPA in place |
Notification of Changes
We will notify customers at least 30 days before adding or replacing a sub-processor. This notice will describe the new sub-processor, its purpose, the data it will process, and its location. If you object to a new sub-processor on reasonable data protection grounds, you may contact us to discuss alternative arrangements.
Subscribe to Updates
To receive notifications about changes to our sub-processor list, please contact us via our contact page with the subject line "Sub-processor Updates" and we will add you to our notification list.