Subprocessors

PRplus engages the following third-party service providers to deliver our product. We require each subprocessor to provide protections at least as strict as our own under their respective data processing agreements.

Last updated: October 27, 2026

Change notifications

We will notify customers of any material change to this list (new subprocessor, region change, or removal) at least 30 days before the change takes effect. Customers with an active DPA can subscribe to change notifications by emailing legal@prplus.io.

Subprocessor	Purpose	Data categories	Region
Supabase Privacy policy	Primary database, authentication, file storage, realtime	All customer content (clients, pitches, reports, team members), auth identities	US (AWS us-east-1)
Vercel Privacy policy	Application hosting, edge network, serverless functions	Request metadata, IP addresses (for abuse prevention), deployment logs	Global (US, EU, APAC edge)
Anthropic Privacy policy	AI model inference (Claude) for pitch writing, agents, reports	Prompt content submitted by users (client context, pitch drafts, agent queries)	US
Stripe Privacy policy	Subscription billing, invoicing, payment processing	Billing email, payment method tokens (never raw card data), invoice history	US / global per Stripe regions
Resend Privacy policy	Transactional email delivery (pitches, notifications, auth emails)	Recipient email addresses, email body content, delivery/open/click events	US
ImprovMX Privacy policy	Forwards email sent to our @prplus.io addresses (support, privacy, legal, security) to our team inbox	Sender address and contents of emails you send to PRplus addresses	See provider privacy policy
Upstash (Redis) Privacy policy	Rate limiting, short-lived cache, in-memory counters	IP addresses and user IDs for rate-limit keys (24h TTL)	US (Global low-latency replication available)
Sentry Privacy policy	Error tracking, performance monitoring	Error stack traces, request metadata, user ID references (never raw content)	US
PostHog Privacy policy	Product analytics (only when the user accepts the cookie banner)	Anonymous usage events, identified user ID when signed in, feature flag evaluations	US (us.i.posthog.com)
Inngest Privacy policy	Background job orchestration (ingestion, digests, alerts, billing crons)	Job payloads referencing org/client/pitch IDs and derived content processed by scheduled + event-driven functions	US
Google Privacy policy	Optional Google sign-in (OAuth identity provider)	Authentication identifiers (email, name, Google account ID) for users who choose Google sign-in	US / global per Google regions
Media & data-source APIs Privacy policy	Media monitoring / ingestion (NewsAPI, Reddit, X/Twitter, SerpAPI, YouTube)	Client-derived search terms and keywords sent as queries; public results returned are stored as mentions	US / global per each provider

Supabase

Purpose: Primary database, authentication, file storage, realtime
Data categories: All customer content (clients, pitches, reports, team members), auth identities
Region: US (AWS us-east-1)

Vercel

Purpose: Application hosting, edge network, serverless functions
Data categories: Request metadata, IP addresses (for abuse prevention), deployment logs
Region: Global (US, EU, APAC edge)

Anthropic

Purpose: AI model inference (Claude) for pitch writing, agents, reports
Data categories: Prompt content submitted by users (client context, pitch drafts, agent queries)
Region: US

Stripe

Purpose: Subscription billing, invoicing, payment processing
Data categories: Billing email, payment method tokens (never raw card data), invoice history
Region: US / global per Stripe regions

Resend

Purpose: Transactional email delivery (pitches, notifications, auth emails)
Data categories: Recipient email addresses, email body content, delivery/open/click events
Region: US

ImprovMX

Purpose: Forwards email sent to our @prplus.io addresses (support, privacy, legal, security) to our team inbox
Data categories: Sender address and contents of emails you send to PRplus addresses
Region: See provider privacy policy

Upstash (Redis)

Purpose: Rate limiting, short-lived cache, in-memory counters
Data categories: IP addresses and user IDs for rate-limit keys (24h TTL)
Region: US (Global low-latency replication available)

Sentry

Purpose: Error tracking, performance monitoring
Data categories: Error stack traces, request metadata, user ID references (never raw content)
Region: US

PostHog

Purpose: Product analytics (only when the user accepts the cookie banner)
Data categories: Anonymous usage events, identified user ID when signed in, feature flag evaluations
Region: US (us.i.posthog.com)

Inngest

Purpose: Background job orchestration (ingestion, digests, alerts, billing crons)
Data categories: Job payloads referencing org/client/pitch IDs and derived content processed by scheduled + event-driven functions
Region: US

Google

Purpose: Optional Google sign-in (OAuth identity provider)
Data categories: Authentication identifiers (email, name, Google account ID) for users who choose Google sign-in
Region: US / global per Google regions

Media & data-source APIs

Purpose: Media monitoring / ingestion (NewsAPI, Reddit, X/Twitter, SerpAPI, YouTube)
Data categories: Client-derived search terms and keywords sent as queries; public results returned are stored as mentions
Region: US / global per each provider

Questions?

For subprocessor-related questions — including DPA requests, regional hosting options, or SOC 2 status — contact legal@prplus.io.