OpenChair Subprocessor List
Version: 2.1.0
Effective date: when this version is published at OpenChair's Subprocessor List URL
OpenChair uses the providers below to operate the platform. A provider processes Customer Data only when the relevant service, integration or feature is used. The listed locations describe principal or potential processing regions and can include support access, resilience locations and onward infrastructure disclosed by the provider.
| Provider | Purpose | Principal or potential processing locations |
|---|---|---|
| Vercel | Web hosting, application execution and edge delivery | United States and global edge locations |
| Supabase | Database, authentication, object storage and realtime services | Selected project regions and provider support/resilience locations |
| Amazon Web Services / Amazon SES | Email delivery and supporting cloud infrastructure | Australia, United States and other configured AWS regions |
| Twilio | SMS and communications delivery | Australia, United States and global communications networks |
| Stripe | Connected payments, billing, fraud controls and payment support | Australia, United States and global payment networks |
| OpenRouter | Routing requests to enabled AI model providers | United States and locations used by the selected downstream provider |
| OpenAI | AI and image-generation functions, including approved staff-assisted data migrations, where enabled | United States and other provider processing locations |
| Anthropic (through OpenRouter) | AI functions where an Anthropic model is enabled | United States and provider processing locations |
| Google AI (through OpenRouter) | AI and image-generation functions where a Google model is enabled | Global provider processing locations |
| Langfuse | AI observability where enabled | Configured hosting region |
| PostHog | Product and website analytics where enabled | Configured hosting region and provider support locations |
| Sentry | Error and performance monitoring where enabled | United States and configured provider locations |
| Expo | Mobile application build, update and push-notification infrastructure | United States and provider delivery networks |
| Google Maps Platform | Maps, address and location functions | Global |
| Google Workspace and Google Calendar | Authentication and venue-enabled calendar connection and synchronisation | Global |
| Microsoft | Venue-enabled Microsoft 365 and Outlook calendar connection and synchronisation | Global |
| Upstash | Redis data storage, abuse prevention, rate limiting and short-lived workflow state | United States, European Union and configured provider regions |
| Slack | Internal support and operational alert routing where enabled | United States and provider processing locations |
| Vapi | Business calling and voice workflow infrastructure where enabled | United States and provider processing locations |
| Apify | Approved social-data and public-web workflows where enabled | European Union, United States and provider infrastructure locations |
| Meta | Venue-configured advertising, attribution or social integrations | Global |
Change process
OpenChair will ordinarily give at least 30 days' advance notice of a material new subprocessor through the registered account contact or in-product notice. Shorter notice may be used where reasonably necessary for security, continuity, law or a provider change OpenChair could not reasonably defer. The Data Processing and Security Schedule explains the Customer's objection and affected-service cancellation rights.
Questions about this list may be sent to privacy@openchairpro.com.