# Subprocessors

beadedcloud (operator of Circumpolar.ai) uses the following third-party processors to run the Service. This list is the source of truth and is updated when a processor is added, removed, or changes role. Substantive changes are also notified to customers whose DPA requires it.

Last updated: 2026-05-29.
Questions: legal@beaded.cloud.

| Processor | Purpose | Location of processing | Customer data touched |
|---|---|---|---|
| **Vercel** | Application hosting, serverless functions, edge runtime, deploy automation | United States (multi-region) | All user-submitted data passes through Vercel during request handling |
| **Neon** | Managed Postgres database (primary datastore) | United States | All persistent user data |
| **Anthropic** | LLM inference for Circe chat and other AI features | United States | The text of user prompts and any context the user provides Circe; not used to train Anthropic's models per their API ToS |
| **Resend** | Transactional email (account, security, support) | United States | Email address and message body |
| **Stripe** | Payments and billing | United States | Payment card data is handled by Stripe directly; we receive a tokenized reference and billing email |
| **GitHub, Google** | OAuth identity providers (sign-in only) | Global | Email and profile name returned by the provider after a user signs in |

The following are infrastructure providers that may incidentally process customer data via the providers above, but with whom beadedcloud has no direct customer-data relationship:

- AWS (used by Vercel and Neon under the hood)
- Cloudflare (used by some providers for edge networking)

## Changes

When a new subprocessor is added or an existing one changes role:
- This page is updated
- The "Last updated" date is bumped
- Customers with a DPA that requires advance notice are emailed at least 14 days before the change takes effect, giving them an opportunity to object
- A short note is also posted to the changelog