Effective date: 2026-08-11 · Version 1.0
This page lists the third-party sub-processors Backstory uses to provide the Service, grouped by which part of the product they support (Core, Contacts, Payments, Email). It is the public-facing summary of our internal Article 30 GDPR processor register, which our engineering and legal teams keep current as the source of truth. If you are a Customer with a signed Core DPA or Leads DPA, those addenda incorporate this list by reference and we will give notice before adding a sub-processor that materially changes processing.
| Sub-processor | Category | Purpose | Location | DPA status |
|---|---|---|---|---|
| Cloudflare | core | Edge compute (Workers) and short-lived session cache (Workers KV) for the tracking script and session hash. | Global (EEA + US) | Self-serve DPA (coverage under review) |
| ipapi.is | core | IP-to-company/ASN lookup for coarse geography and company enrichment. | Germany (EEA) | Signed |
| Supabase | core | Authentication and primary application database (accounts, organizations, journey/analytics data). | TBD — verify project region | Not signed |
| Vercel | core | Application hosting for the dashboard (edge/serverless functions, request routing). | TBD — verify project/function region | Self-serve DPA (acceptance unconfirmed) |
| Sentry | core | Error tracking/monitoring for the application. | TBD — verify org data-residency setting | Standard DPA (acceptance unconfirmed) |
| Anthropic | core | Large-language-model inference for AI-assisted classification features (e.g. company-quality filtering, job-title expansion, intent scoring). | US | Commercial DPA (execution unconfirmed) |
| GetProspect | contacts | Lead data lookup and reveal (name, business email, job title, LinkedIn URL) for the optional Contacts add-on. Legal entity: GetProspect LLC. | DigitalOcean data centres (region not published); encrypted at rest and in transit | Not signed — Leads DPA required before use. GetProspect does not publish an itemised sub-processor list; its pre-approved sub-contractor list is available on request from support@getprospect.com (30 days' notice + right to object to new sub-processors). |
| Stripe | payments | Payment processing and subscription billing. | Global (US company; Stripe Payments Europe Ltd for EEA merchants) | Incorporated by reference in the Stripe Services Agreement |
| Resend | Transactional email (invitations, account/billing notifications). | US | Standard DPA (acceptance unconfirmed) |
We review this list, and the underlying Article 30 register, on a quarterly basis and whenever a new sub-processor is added. Questions or objections: legal@trybackstory.com.