Subprocessors
Every company that handles your data for us, what it does, and where.
Last updated 23 October 2026.
| Company | What for | Which data | Where |
|---|---|---|---|
| Supabase | Database, sign-in (including, for now, sending sign-in emails), file storage and the search index. | Your documents, questionnaires, answers and account email addresses. | United States (AWS us-east-1, N. Virginia) |
| Amazon Web Services | EC2: the server that checks, reads and answers. Bedrock (Amazon Rerank): ranks the passages found for each question by relevance. ECR: our software images (no customer data). | Documents while they are processed on our server. For ranking: each question and the passages of your documents found for it. AWS states it does not use Bedrock inputs or outputs to train models. | United States (EC2 us-east-1, N. Virginia; Bedrock us-west-2, Oregon) |
| Cloudflare | Website and app hosting, DNS, and the encrypted proxy in front of our server. | All traffic passes through it, encrypted end to end to our server. | Global network |
| Google (Gemini API, paid tier) | Search vectors and drafting answers from your documents. | Passages of your documents and the questions. Not used to train Google's models. | Google's global infrastructure |
| Resend (not used yet) | From before our first customer: sign-in emails and our own operational alerts. Until then Supabase sends sign-in emails. | Your email address. Alerts contain ids and counts only. | United States |
| Sentry | Error reports, so we can fix bugs. | Technical error data only. Document text, questions and request contents are removed before sending. | United States |
| Tally | The contact form on citesheet.com. | What you type into the form. | European Union |
Changes
Before we add or replace a company that handles customer documents, we update this page and email customers at least 30 days in advance. If you object, tell us and we will work it out with you, or you can delete your data and leave.
Questions: hello@citesheet.com.