Subprocessors
Last updated June 2026.
The infrastructure providers that help us run CustodyLinx. Kept deliberately small, all under confidentiality and security terms.
What a subprocessor is
A subprocessor is a third party we use to help deliver CustodyLinx that may process operator data on our behalf, under contractual confidentiality and security terms. We keep the set small and infrastructure-grade.
Current subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting, edge delivery, and serverless functions for the web app and APIs | United States (global edge) |
| Supabase | Primary Postgres database, authentication, and private document storage | United States |
| Render | Long-running background workers: regulator sync, document scanning, and sensor and telemetry ingest | United States |
Regulatory systems of record
When an operator directs CustodyLinx to file to a government track-and-trace system (for example Metrc, BioTrack, or Canada CTLS), data is transmitted to that regulator at the operator's instruction. These government systems are recipients the operator is legally required to file to, not commercial subprocessors, and they are listed here for transparency.
Messaging and email
Operational email and SMS providers are finalized before any production messaging is enabled, and this list is updated when they are. Until then, no third-party messaging subprocessor receives operator data.
Changes
We will update this page before a new subprocessor begins processing operator data, so operators can review the current list. Contractual customers may request advance notice of changes.