Skip to main content
DemarcLabs
Customer Login

Subprocessor register

Know which providers support DemarcLabs and why they receive data.

This register reflects the DemarcLabs Production architecture as of August 31, 2026. The applicable Order Form and Data Processing Addendum define which optional providers and data categories are enabled for a customer environment.

Core Production infrastructure

Current service providers

Vercel

Active
Purpose
Application hosting, deployment, edge delivery, and minimized operational logs.
Data involved
Web requests, application responses, and limited operational metadata.
DemarcLabs boundary
Source documents are handled only through protected application routes.

Supabase

Active
Purpose
Authentication, Postgres records, and private object storage.
Data involved
Account identity, organization records, reviewed data, audit history, and private source documents.
DemarcLabs boundary
Tenant row-level security and private storage policies enforce organization access.

Optional service providers

Provider use follows the customer environment

Some services are activated according to the customer's contracted scope and environment configuration. DemarcLabs limits each provider to the data required for that service.

Cloudmersive

Provides malware screening for customer environments that accept document uploads. A clean result is required before private storage.

OpenAI

Provides Relay document classification and structured extraction for customer environments using Relay. Requests use strict schemas, human review, and disabled response storage.

Resend or another approved email provider

Provides authentication and minimized service notifications for customer environments using email delivery.

Stripe

Provides subscription status and billing workflows for customers using platform billing. Source documents remain outside this flow.

Every provider follows the same boundary.

An integration does not create permission to receive Customer Content. DemarcLabs requires product, security, and legal review, minimum-data design, access control, defined failure behavior, retention terms, and customer disclosure.

DemarcLabs updates this register before a new provider begins processing Customer Content and communicates material changes through the customer-notice channel.

Review privacy practices