Sub-processor list
1. Overview
Get Causality uses the following third-party sub-processors to deliver our services. In accordance with GDPR Art. 28 and our Data Processing Agreement, we maintain this list of authorized sub-processors and provide 30 days advance notice of any changes.
2. Current sub-processors
| Sub-processor | Purpose | Location | Compliance | Data processed |
|---|---|---|---|---|
| Vercel Inc. | Application hosting (frontend CDN + serverless API functions) | USA (global edge) | SOC 2 Type II, ISO 27001 | All platform data in transit. Vercel is the compute host: serverless functions process every API request, so personal data is present in plaintext in function memory while a request is handled, and Vercel Edge derives coarse geolocation headers from the connecting IP. Nothing is persisted at Vercel; PII is encrypted at the application layer (AES-256-GCM) before it is written to the database. |
| Neon Inc. | PostgreSQL database | USA (AWS us-east-1) | SOC 2 Type II | All stored data. PII is AES-256-GCM encrypted at the application layer before storage, and Neon does not hold the encryption key. Six fields on a survey response are stored in the clear: the coarse location derived from the connecting IP (latitude and longitude), a caller-supplied respondent ID and referral parameter, and two device fingerprints. |
| Cloudflare Inc. | Edge protection — Web Application Firewall (WAF), DDoS mitigation, bot management (Turnstile), TLS termination | Global edge network | SOC 2 Type II, ISO 27001, PCI-DSS | Edge requests pass through Cloudflare's global network for security inspection. No persistent storage of user data; data is in transit only. |
| Google LLC | Google OAuth sign-in as an optional account authentication method. Bot detection was removed 2026-09-16; Cloudflare Turnstile is now the sole provider. | USA | SOC 2 Type II, ISO 27001 | For OAuth sign-in, the account holder's email address and display name are read at the authorization callback. Nothing else is sent. Until 2026-09-16 reCAPTCHA Enterprise also sent assessment tokens and exposed the respondent's IP to Google on public form submissions; that was removed, so a survey submission now reaches Google not at all. No survey content or respondent data is shared. |
| GitHub, Inc. (Microsoft Corporation) | GitHub OAuth sign-in ("Log in with GitHub") as an optional account authentication method | USA | SOC 2 Type II, ISO 27001 | The account holder's verified primary email address and GitHub username, read at the authorization callback. Applies to platform account holders only; no respondent or survey data is shared. |
| Stripe Inc. | Payment processing for paid plans | USA | PCI DSS Level 1 | The account holder's email address and internal user ID (sent when the Stripe customer record is created), subscription and payment metadata, and the billing address and tax ID Stripe collects directly at checkout. Card details are handled entirely by Stripe and never touch our servers. |
| Resend Inc. | Transactional email delivery | USA | SOC 2 Type II | Email addresses (for delivery) and email content (verification, password reset, notifications). |
| PostHog Inc. | Anonymous product analytics + server-side security telemetry | USA | SOC 2 Type II | Anonymized usage events only (page views, feature usage). Consent-gated for analytics. Server-side security telemetry under legitimate interest (Art. 6(1)(f)) tagged category=security; contains no email, IP, or response contents. No PII transmitted. Session recording disabled. |
| Sentry Inc. | Error monitoring | USA | SOC 2 Type II | Stack traces and browser metadata for debugging. PII is scrubbed via a beforeSend hook before transmission (sendDefaultPii: false). Frontend Sentry is consent-gated; backend Sentry runs unconditionally for production reliability. |
3. Data-protection measures
All sub-processors are bound by Data Processing Agreements that include, in order of priority for each transfer corridor:
- EU-U.S. Data Privacy Framework (where the sub-processor is certified)
- Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, in the module matching our own role for the data being transferred: Module 2 (controller-to-processor) for account and platform data, where we are the controller; Module 3 (processor-to-processor) for survey response and respondent data, where the researcher is the controller and we are ourselves a processor onward-transferring to our sub-processor
- UK International Data Transfer Addendum or UK Extension to the DPF for UK transfers
- Swiss-U.S. DPF or SCCs adapted for Switzerland per FDPIC guidance
- Obligation to implement appropriate technical and organizational measures
- Breach notification to us without undue delay (GDPR Art. 33(2))
- Data deletion upon termination, per the retention schedule below
4. Essential services
Stripe (payment processing, when active) and Cloudflare Turnstile (bot protection) are classified as essential / functional services required for platform operation and security. These services are loaded without requiring analytics cookie consent, as they are necessary for the legitimate functioning of the platform.
5. Retention schedule
Personal data retention is governed by the schedule below. Sub-processors hold data only for the duration we hold it as Controller; once we delete, our standard Data Processing Agreement requires sub-processors to delete within their backup-rotation cycle.
| Data category | Active | Grace | Backups | Hard delete |
|---|---|---|---|---|
| Account data | Indefinite while active | 30 days | 30 days | Day 60 from cancellation |
| Survey responses | Per researcher's data_retention_days (platform default 730 days for surveys created on or after 2026-09-14; earlier surveys with no period set are retained until the survey or the account is deleted) | 30 days | 30 days | Day 60 |
Cognitive profiles (extracted_concepts) | Per fcm_retention_days (default 365 days) | n/a | n/a | Profile and identifiers deleted at the retention period; anonymized response data retained for research only |
| Audit logs (security) | 2 years (24 months) from event date | After 2 years | ||
| Payment metadata | Deleted with the account cascade 30 days after a deletion request. Tax and accounting records are held by Stripe under Stripe's own retention policy, not by us. | Day 30 | ||
| Breach records | Indefinite (Art. 33(5)) | — | ||
Full per-category schedule is published in our retention reference documentation (opens in new tab).
6. Changes to sub-processors
We provide at least 30 days advance notice before adding, removing, or replacing any sub-processor. Notifications will be sent to institutional contacts on file and reflected on this page.
7. Contact
- Data Protection Officer: [email protected]
- Privacy inquiries: [email protected]