Subprocessors and suppliers

Infrastructure

• Supabase — authentication, database, storage, and backend functions.
• Vercel — website hosting and technical infrastructure logs.
• Railway — technical report processing and orchestration of professional AI functions.

Communications

• OneSignal — push orchestration and device technical data.
• Google Firebase Cloud Messaging — Android push delivery.
• Apple Push Notification service — iOS push delivery.
• Amazon Web Services SNS — SMS delivery in configured workflows.

Content, documents, and AI

• Bunny Stream — educational video hosting and playback.
• Focus NFe — tax-document issuance and queries when the feature is enabled.
• OpenAI — neutral transcription, translation, summarization, formatting, or organization in enabled professional functions; it does not make clinical recommendations.

Use rules

Being listed here does not mean that every provider receives every data type or is active for every user. Access must be limited to what the function needs.

Use of each provider with personal data depends on a security and privacy assessment, contractual protection, retention and deletion controls, and a valid international-transfer mechanism. We will update this list before material changes. Questions: contact@cpapcalm.com.