Subprocessors
Last updated · 2026-05-22
KeenDraft uses the following third-party services to deliver its product. Each is bound by a data processing agreement (DPA) and a stated, limited purpose. Engaging a new subprocessor is announced on this page at least 30 days before activation.
| Provider | Purpose | Region | DPA |
|---|---|---|---|
| Supabase All envelope metadata, PDFs, audit events, user accounts, organization records, fields, recipients. | Managed Postgres, authentication, and object storage | US (us-east-1) | View |
| Vercel Request metadata and TLS-terminated traffic. Application logs may contain envelope IDs and user IDs. | Application hosting and global edge network | Global edge · primary in US | View |
| Brevo Recipient names, recipient email addresses, envelope titles, sender names, magic-link URLs. | Transactional email delivery (invitations, reminders, completions) | EU (France) | View |
| Stripe Account holder email, payment method details, subscription state. Card data is held by Stripe, never KeenDraft. | Subscription billing and payment processing | US, EU | View |
| Upstash Envelope IDs, recipient IDs, and scheduling metadata. No document content. No PII beyond identifiers. | Scheduled jobs (QStash) and rate-limiting | Multi-region (US, EU) | View |
| Sentry Stack traces, request paths, user IDs (no signer data), and a sampled subset of request metadata. | Error monitoring and performance traces | US | View |
| PostHog Anonymous or pseudonymous usage events from visitors who have accepted analytics cookies. No envelope content. | Consented product analytics | EU (cloud-eu) | View |
- Purpose
- Managed Postgres, authentication, and object storage
- Data shared
- All envelope metadata, PDFs, audit events, user accounts, organization records, fields, recipients.
- Region
- US (us-east-1)
- Purpose
- Application hosting and global edge network
- Data shared
- Request metadata and TLS-terminated traffic. Application logs may contain envelope IDs and user IDs.
- Region
- Global edge · primary in US
- Purpose
- Transactional email delivery (invitations, reminders, completions)
- Data shared
- Recipient names, recipient email addresses, envelope titles, sender names, magic-link URLs.
- Region
- EU (France)
- Purpose
- Subscription billing and payment processing
- Data shared
- Account holder email, payment method details, subscription state. Card data is held by Stripe, never KeenDraft.
- Region
- US, EU
- Purpose
- Scheduled jobs (QStash) and rate-limiting
- Data shared
- Envelope IDs, recipient IDs, and scheduling metadata. No document content. No PII beyond identifiers.
- Region
- Multi-region (US, EU)
- Purpose
- Error monitoring and performance traces
- Data shared
- Stack traces, request paths, user IDs (no signer data), and a sampled subset of request metadata.
- Region
- US
- Purpose
- Consented product analytics
- Data shared
- Anonymous or pseudonymous usage events from visitors who have accepted analytics cookies. No envelope content.
- Region
- EU (cloud-eu)
Get notified when this list changes
We announce any new subprocessor at least 30 days before activation. Email legal@keendraft.com with subject "Subprocessor notifications" to be added to the list, or follow our changelog (coming soon).