Sub-processors
We use a small number of carefully chosen vendors to operate the Service. Each is bound by data-protection terms equivalent to those we offer you.
5.1 — Current sub-processor list (as of this Policy version)
| Vendor | Role | Data categories | Region |
|---|---|---|---|
| Supabase | Database, authentication, storage | Account data, service inputs and outputs, audit log | United States (primary) |
| Fly.io | Application hosting and container orchestration | All Service traffic; transient processing | Multi-region (primary US; edge regions where required for performance) |
| Stripe | Payment processing, tax automation, invoicing | Billing information, transaction history, tax data | United States (with global edge for Stripe Tax) |
| Resend | Transactional email delivery | Email address, message content of transactional emails | United States |
| Anthropic | AI model inference (Claude family models) for producing verdicts, scoring, and structured outputs | Service inputs (prompts and contexts); model outputs returned to OntoRamp | United States |
| Vercel | Hosting and edge delivery of the OntoRamp website and web application | Web/application requests; IP address and request metadata; transient processing | United States (primary; global edge network) |
5.2 — Notice of changes
We will notify you of new sub-processors before they begin processing your data. Notice is given via:
- email to the account-admin contact, AND
- update to this Policy with a new effective date
Customers on a Data Processing Addendum (see Data Processing Addendum) may object to new sub-processors per the terms of that addendum.
5.3 — Cross-border transfers
Most sub-processors are based in the United States. Where personal data is transferred from the EU, EEA, or UK to the United States (or to other countries without an adequacy decision), we rely on:
- the EU Standard Contractual Clauses (2021 SCCs, Module 2 controller-processor and Module 3 processor-processor as applicable), and
- the UK Addendum to the EU SCCs
Copies of these are available on request to m@ontoramp.com and are referenced in our Data Processing Addendum.