Subprocessors

Last updated: June 20, 2026

Crutan LLC uses the following subprocessors to operate the service. Each is bound by a data processing agreement at least as protective as our DPA, and each maintains independent security certifications (SOC 2 Type II or equivalent). Some providers (e.g. CRM, scheduling, and booking tools) are engaged only when a customer or visitor chooses to connect or use them.

Provider	Purpose	Data involved	Region
Vercel	Website & app hosting, edge network, serverless compute	Request logs, generated page content	US/EU edge
Railway	Background job & worker hosting	Job payloads referencing workspace records	US
Supabase	Primary database, authentication, storage	Workspace data, prospect records, engagement events, site leads/identities	US
Stripe	Payments and billing	Billing contact, payment method (never stored by Crutan)	US/EU
Resend	Transactional and lifecycle email	Recipient email, message content	US
PostHog	First-party product and site analytics (consent-gated on the site)	Usage events, device data	US
Anthropic	LLM inference for research and copy generation	Company research context (no recipient PII required)	US
OpenAI	LLM inference for research and copy generation	Company research context (no recipient PII required)	US
Inngest	Background job orchestration	Job payloads referencing workspace records	US
IPinfo	Reverse-IP company/organization enrichment (consent-gated on the site)	IP address (not stored raw), derived company/geo	US
HubSpot	CRM sync / lead routing where the customer connects it	Lead & contact records, engagement signals	US/EU
Cal.com	Meeting scheduling on booking CTAs	Name, email of people who book	US/EU

Change notifications

We give workspace owners at least 14 days' notice by email before adding a subprocessor that will process customer personal data. To subscribe additional recipients, email legal@crutan.comwith the subject “subprocessor updates”.