Current and expected subprocessors
| Vendor | Purpose | Data categories | Location/status |
|---|---|---|---|
| Supabase | Authentication, Postgres database, storage, realtime, edge functions | Account, workspace, job, location, attendance, forms, files, and logs | Current; region depends on the configured Supabase project |
| Vercel or chosen web host | Next.js application hosting, API hosting, deployment logs | Account identifiers, request metadata, operational logs | Current or deployment-dependent |
| Mapbox | Maps, geocoding, navigation, route and travel estimates | Addresses, coordinates, route requests, map usage metadata | Current where map/geocode/route features are enabled |
| Expo | Mobile builds, app updates, and legacy Expo push notification delivery during migration | Build metadata, update metadata, and legacy Expo push token or notification payload metadata where applicable | Current for builds/updates; legacy for Expo push delivery |
| Apple Push Notification service | iOS push notification delivery | Push delivery metadata and notification payloads | Current for iOS notifications |
| Firebase Cloud Messaging / Google Play services | Android push notification delivery and app distribution services | Push delivery metadata and notification payloads | Current for Android notifications |
| [Email provider] | Invitations, password resets, support, billing notices | Email address, name, account and invitation metadata | Planned |
| [Payments provider] | Subscription billing, invoices, tax, payment processing | Billing contact, plan, invoice and payment metadata | Planned |
| [Monitoring provider] | Error monitoring, uptime, application diagnostics | Request metadata, device metadata, error traces, logs | Planned |
Change notices
Tandem should provide customer notice before adding a material new subprocessor that processes customer personal data. The notice period, objection process, and fallback rights should be finalized in the customer contract and Data Processing Addendum.
Customer review before launch
Before paid sale, replace planned providers with the actual production providers, confirm hosting/database/storage regions, sign any required data processing terms, and publish a support contact for subprocessor questions or objections.