Subprocessors
Last updated: June 10, 2026
Crutan uses the following subprocessors to operate the service. Each is bound by a data processing agreement at least as protective as our DPA, and each maintains independent security certifications (SOC 2 Type II or equivalent).
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Vercel | Application hosting, edge network, serverless compute | Request logs, generated page content | US/EU edge |
| Supabase | Primary database, authentication, storage | Workspace data, prospect records, engagement events | US |
| Stripe | Payments and billing | Billing contact, payment method (never stored by Crutan) | US/EU |
| Resend | Transactional and lifecycle email | Recipient email, message content | US |
| PostHog | First-party product and site analytics | Usage events, device data (IP truncated) | US |
| Anthropic | LLM inference for research and copy generation | Company research context (no recipient PII required) | US |
| Inngest | Background job orchestration | Job payloads referencing workspace records | US |
| IPinfo | Company enrichment from IP / domain | IP address, domain | US |
| Cal.com | Meeting scheduling on booking CTAs | Name, email of people who book | US/EU |
Change notifications
We give workspace owners at least 14 days' notice by email before adding a subprocessor that will process customer personal data. To subscribe additional recipients, email legal@crutan.comwith the subject “subprocessor updates”.