Sub-processors
Last Updated: November 7, 2026
Firma uses the third parties below to provide the Services. Each one processes personal data only as needed for the purpose listed and is bound by data protection terms with Firma. This list forms part of the Data Processing Agreement.
Before adding or replacing a sub-processor, Firma updates this page at least 30 days in advance. To get notified of changes by email, or to object to a change, write to privacy@tryfirma.com.
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Supabase, Inc. | Database, authentication and file storage (hosted on AWS) | Account data, directory profile fields, signature content, uploaded images | United States (AWS us-west-1) | EU SCCs |
| Vercel Vercel Inc. | Application hosting and server functions | Data in transit while requests are processed, request logs | United States | EU SCCs |
| Google Google LLC | Sign-in, Google Workspace APIs, support email, website analytics | Account data, directory profile fields, support correspondence | United States and global | EU-US DPF, EU SCCs |
| Microsoft Microsoft Corporation | Microsoft 365 sign-in and Microsoft Graph directory APIs | Directory profile fields | United States and global | EU-US DPF, EU SCCs |
| PostHog PostHog, Inc. | Product analytics and error tracking | Account user id, usage events, email (only with analytics consent) | United States | EU SCCs |
| Resend Plus Five Five, Inc. (Resend) | Transactional email (invitations, account notices) | Name, email address | United States | EU SCCs |
| Paddle Paddle.com Market Ltd | Payments and billing (merchant of record) | Billing contact and payment details of the paying admin | United Kingdom | UK adequacy decision |
| Anthropic Anthropic, PBC | AI assistance for customer support, troubleshooting and product analysis | Names, email addresses, account and usage data needed for the task | United States | EU SCCs |
| Cursor Anysphere, Inc. (with its model providers, including xAI) | AI-assisted development and troubleshooting, Privacy Mode enabled | Names, email addresses, account and usage data needed for the task | United States | EU SCCs |
Firma never accesses the content of your emails, so none of these providers receive email content from Firma. AI providers are used under business or API terms, or with Privacy Mode enabled, under which data is not used to train their models.