Trust Centre
Subprocessors
Last updated 3 October 2026
SkySign uses the providers below to operate the service. They are engaged under written terms, their access is limited to what the service requires, and customer documents are never sold or used for advertising. We update this page before adding a provider that would process customer personal data; customers with a Data Processing Agreement in place are notified in line with its terms.
Current subprocessors
| Provider | Purpose | Data potentially processed | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All application data: organisation and account details, user profiles and credentials (password hashes), uploaded documents, written documents and messages, acknowledgement records and the audit log. Sends authentication emails such as invitations. | AWS; project region to be confirmed |
| Vercel | Application hosting, server-side functions and scheduled jobs | Every request to the service passes through Vercel. Function logs may contain request paths and, for email sending, message subjects (which include document titles). | Global edge network; function region to be confirmed |
| Resend | Transactional email delivery | Recipient name and email address, organisation name, document title and description or message body, due date and the link to the document, for assignment notifications and reminders. Support and demo-request emails sent to SkySign. | See provider |
| Stripe | Subscription billing | The administrator’s email address, organisation name and subscription details. Card details are entered on Stripe’s hosted pages and never reach SkySign. No employee data or documents. | See provider |
| Anthropic | Optional AI features (PDF summary, writing assistant) | Only when an administrator uses the feature: text extracted from the PDF being summarised, or the editor text selected for rewriting. No employee data, acknowledgement records or account data. Not used to train Anthropic’s models under its commercial API terms. | See provider |
| Sign in with Google (optional); website analytics on the public marketing site only | For sign-in: the Google identity token (email, name) exchanged for a SkySign session. For analytics: pseudonymous usage data and cookies on the public marketing pages. Analytics is not loaded inside the signed-in application. | See provider |
What this list does not mean
- Not every provider receives customer documents. Only Supabase stores them; Anthropic receives extracted text only when an administrator asks for a summary or rewrite; Resend receives document titles and message bodies in notification emails.
- No provider is given access to acknowledgement records or audit logs except Supabase, where they are stored.
- Providers act on SkySign’s instructions as sub-processors; they do not use customer data for their own purposes.
Providers that run locally, not as subprocessors
PDF text extraction, hashing, PDF report generation and the document editor run inside SkySign’s own application code. No data leaves the service for these features.
Changes and questions
Questions about any provider, or requests for a copy of our provider terms, can be sent to privacy@useskysign.com. See also the Security & Trust page and the Data Processing Agreement.