Legal centre
Sub-processors
We use the smallest set of providers the platform can run on. This list forms part of the Privacy Policy and is kept current; customers under contract are notified before a new sub-processor is added.
Last updated 26 July 2026
1. Current sub-processors
| Provider | Role | Data involved | Region |
|---|---|---|---|
| Vercel | Application hosting and serverless compute | Requests in transit, technical logs | Serverless functions pinned to Tokyo (hnd1); global edge network for static assets |
| Supabase | Managed Postgres database, object storage for uploaded files, realtime channel | All workspace content and account data | Asia-Pacific (Tokyo), ap-northeast-1 |
| Generative model API for AI-assisted drafting and summarising — only when an administrator enables AI features, and only for records referenced by a user's request | The specific records included in a request | Provider-operated regions | |
| Resend | Transactional email delivery, where email is configured for a deployment | Recipient address and message content | Provider-operated regions |
Google is engaged only for the AI features. A deployment with AI switched off does not send data to it at all. Resend is engaged only where transactional email is configured.
2. How they are engaged
- Each provider is bound by contract to process data only on our instructions.
- Each is selected for its security posture and for the ability to keep data in the intended region where the service allows it.
- We remain responsible to our customers for their performance.
3. Changes
We will give customers under contract reasonable advance notice before adding or replacing a sub-processor, so that a documented objection can be raised as any signed data-processing addendum provides. To be notified of changes, write to privacy@manzilone.com.