Subprocessors
Who helps us run Cellar
Last updated July 2026
We use a small, vetted set of infrastructure providers. They process data only to deliver the product, under data-protection agreements. We'll give notice before adding a new one.
Current Subprocessors
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Authentication and the encrypted database | EU / US |
| Cloudflare R2 | Encrypted document storage (ciphertext only) | EU / US |
| Amazon Web Services | In-region AI processing (Bedrock) and key management (KMS) | EU / US |
| Anthropic | The model that reads and organizes documents under no-training processing terms | EU / US |
| Google Cloud | In-region text recognition (OCR) on scanned documents, under no-training processing terms (Vertex AI) | EU / US |
| Stripe | Subscription billing | Global |
| Resend | Transactional email and sign-in links | Global |
| Vercel | Application hosting | Global |
| Sentry | Error monitoring and diagnostics | EU |
What they never receive
Your account key is never shared with any subprocessor. Blob storage holds ciphertext only. The processing model receives plaintext transiently only to do the work you requested.
No analytics or advertising providers
We use no analytics, advertising, marketing, or tracking provider, so none appears above. Channel measurement (which tagged link or campaign a signup arrived through) is first-party and aggregate; no provider is involved. The only diagnostics partner is Sentry, our error monitor, which receives scrubbed crash and failure reports with no record content, document names, or share tokens.
Change notice
We keep this list current and give notice before adding a subprocessor that materially changes how health-record data is processed or where it is processed.