Subprocessors
Last updated 2026-05-16
Spondeo uses the following subprocessors to deliver the Service.
We notify customer admins by email at least 30 days before we add a new subprocessor that processes customer or signer content, and offer a reasonable mechanism to object before the change takes effect. To subscribe to subprocessor notifications, email [email protected].
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Vercel, Inc. | Application hosting (compute + edge network). | All request data passing through the application — HTTP requests, response bodies, logs. | United States (iad1 / sfo1 by default). |
| Neon, Inc. | Primary relational database (PostgreSQL). | Customer account records, workspace data, envelopes, recipients, audit events, hashed API keys. | United States (AWS us-east region). |
| Vercel Blob (Vercel, Inc.) | Object storage for source documents and finalized signed PDFs. | PDFs uploaded by customers and the finalized signed PDFs (which include signer field values). | United States. |
| Upstash, Inc. | Redis instance for distributed rate-limiting and ephemeral signing-link state. | Rate-limit counters keyed by IP and signing-link token. No document content. | United States. |
| Resend, Inc. | Outbound transactional email delivery (magic-link login, signer invitations, completion notifications). | Recipient email addresses, sender name, envelope subject/body, the signing-link URL. | United States. |
| Google LLC (Google Cloud Platform — Document AI + Vertex AI) | AI-assisted field detection on uploaded templates (Document AI Form Parser + Gemini classification). | Template PDF bytes during the field-detect operation; no signer data, no completed-envelope data. | United States (us / us-central1). |
| Anthropic, PBC | AI assistance for selected internal workflows (e.g. legacy ai-detect path); not used to train on customer data. | Limited to whatever input we pass into a specific API call (typically a single template at field-detect time). | United States. |
Onboarded customers under specific agreements
If your DPA names additional contractually committed subprocessors or excludes any listed above, those terms govern over this page for your account.
Internal-only services
We use additional vendors that do not process customer or signer content (error monitoring, support tooling, payroll, etc.). These are not subprocessors under GDPR and are not listed here.
Questions? Email [email protected]. The full Privacy Policy is at /legal/privacy.