Subprocessors
Last reviewed: 2026-05-13
Adship engages the third-party processors below to deliver the Service. Each vendor is bound by a Data Processing Agreement (DPA) and processes only the categories of personal data necessary for the stated purpose.
Change notice. We commit to providing at least 30 days' advance notice (via email to billing contacts and an updated date on this page) before adding a new subprocessor that materially expands the scope of personal-data processing. Customers may object during the notice window via support@adship.ai.
Risk notice for AI providers. Groq, kie.ai, and Hedra do not publish SOC 2 Type II reports as of 2026-Q1. We minimize the data sent to these providers via server-side PII sanitization (emails, phone numbers, credit cards, IBANs, and SSNs are redacted before any prompt leaves our infrastructure). Customers on regulated workloads should contact us to discuss alternatives.
| Vendor | Purpose | Region | Data categories | Certifications | DPA |
|---|---|---|---|---|---|
| Supabase | Primary database, authentication, edge functions, file storage | EU (eu-west-1) | Account, profile, ad config, AI generations, audit logs, files | SOC 2 Type II, HIPAA | DPA |
| Vercel | Frontend hosting, edge runtime for API routes | Global edge (US, EU, APAC) | Request metadata, build artifacts, logs | SOC 2 Type II, ISO 27001 | DPA |
| Stripe | Payment processing, subscription management | US + EU | Payment method, billing address, transaction history | PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II | DPA |
| Sentry | Application error monitoring | US (us.sentry.io) | Error stack traces, request URLs (scrubbed), browser info | SOC 2 Type II, ISO 27001 | DPA |
| Resend | Transactional email delivery (welcome, alerts, digests) | US + EU | Recipient email, subject, send timestamp | SOC 2 Type II | DPA |
| Cloudflare | DNS, CDN, DDoS protection | Global edge | Request metadata (IP, user agent, geo) | SOC 2 Type II, ISO 27001, PCI DSS, GDPR Cloud Code of Conduct | DPA |
| Upstash | Redis-backed rate limiting for API endpoints | EU (eu-west-1) | IP addresses (transient, TTL ≤ 5 min) | SOC 2 Type II | DPA |
| OpenAI | AI text generation (specific features only) | US | Prompts (PII-sanitized before send) | SOC 2 Type II: Zero Data Retention amendment available | DPA |
| Groq | Fast LLM inference for chat support, ad copy, comment replies | US | Prompts (PII-sanitized before send) | No public SOC 2 Type II as of 2026-Q1, see risk notice below | DPA |
| kie.ai | AI video generation (Kling models) | US / CN | Generation prompts, source images | No public SOC 2, see risk notice below | Contact support@adship.ai for current DPA terms |
| Hedra | AI talking-avatar video generation | US | Source avatar image, voice audio, prompt | No public SOC 2, see risk notice below | Contact support@adship.ai |
| ElevenLabs | Voice synthesis, voice cloning | US + EU | Voice samples, generation text | SOC 2 Type II, GDPR-compliant | DPA |
| Microsoft Clarity | Anonymous product analytics (post-consent) | US | Session recordings (auto-masked), click/scroll events | SOC 2 Type II, ISO 27001 | DPA |
| Google Analytics 4 | Aggregate usage metrics (post-consent) | US + EU | Page views, events, IP (anonymized), device info | SOC 2 Type II, ISO 27001 | DPA |
Contact support@adship.ai to request a signed Standard Contractual Clauses (SCC) version of any DPA, or for security-questionnaire intake.