// Legal
Subprocessors
- Last updated
- AUGUST 27, 2026
- Entries
- 12
These are the service providers that process personal information on our behalf. Each one is bound to process it only on our instructions and only for the purpose named below.
The list includes providers that receive information passively — a font or image host sees your IP address and browser when a page loads, whether or not we send it anything. It excludes services that handle no personal information of visitors or subscribers.
This page is maintained separately from the Privacy Policy so the list can be kept current without reissuing the policy itself. The date above moves whenever the table does.
| Provider | Purpose | Processing location |
|---|---|---|
| Supabase | Application database, authentication, and subscriber records. Holds account email, subscription state, and consent decisions. | United States (AWS us-west-2) |
| Vercel | Hosting and content delivery for this site and the intelligence portal. Processes request metadata, including IP address. | United States |
| Stripe | Subscription checkout, payment processing, billing portal, and invoices. Holds billing name, email, and card details — we never receive card numbers. | United States, with global processing |
| n8n Cloud | Workflow automation for intelligence collection, brief assembly, email dispatch, and statutory renewal notices. Processes subscriber email addresses and delivery state. | European Union (n8n GmbH, Germany) |
| Gmail delivery of intelligence briefs to subscribers, and Google Fonts, which receives an IP address and user agent when a page loads. | United States, with global processing | |
| Resend (Plus Five Five, Inc.) | Transactional email, brief delivery, and delivery and list management for The Daily Signal. Processes subscriber email addresses, delivery outcomes, and link-click events. | United States |
| Anthropic | Claude models used to synthesise intelligence briefs and reports from collected open-source material. Receives source material, not subscriber data. | United States |
| OpenAI | Text embeddings powering semantic search across the signal corpus. Receives signal and query text, not subscriber identifiers. | United States |
| Mapbox | Map tiles and geocoding for the tactical map. Receives an IP address and map viewport when the map is used. | United States |
| Notion | Destination for in-product bug reports. Receives whatever a subscriber writes in a report, plus the reporting account's identifier. | United States |
| FlagCDN | Country flag images used in the portal interface. Receives an IP address and user agent when an image loads. | Content delivery network, global edge |
| X (Twitter) | Advertising measurement on the marketing site. The X Website Tag receives an IP address, user agent, page URL and referring page, plus a conversion signal when a newsletter signup completes. No email address or other identifier is attached. Loads only for visitors who allow the advertising category, and not at all for an opt-out or a Global Privacy Control signal. | United States |
Changes to this list#
We update this page when a provider is added, removed, or changes what it does for us. If you want to be told before a new provider starts processing your information, write to privacy@treadstonecollective.com and we will add you to the notice list.