Subprocessors
Last updated 29 August 2026
We use a small number of vetted providers to run Erissa. Each is bound by an Article 28 data processing agreement and may only act on our instructions. We give 30 days' notice before adding a new subprocessor, and you may object.
| Provider | Purpose | Data | Location / safeguard |
|---|---|---|---|
| Supabase | Database, auth and file storage | Account, conversations, memories | EU region; SCCs + UK Addendum where applicable |
| Model provider (via our AI gateway) | Generating replies and memory extraction | Message content and retrieved memories | EU/US; SCCs + UK Addendum, no training on your data |
| Stripe | Payments and subscription management | Email, billing details | EU/US; SCCs + UK Addendum |
| Email delivery provider | Transactional and (opt-in) marketing email | Email address, message content | EU/US; SCCs + UK Addendum |
| Hosting / CDN | Serving the app | IP address, request logs | EU edge; SCCs + UK Addendum |
Transfer safeguards
Transfers outside the UK/EEA rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a transfer impact assessment and encryption in transit and at rest.
Data processing agreement
If you use Erissa as a business and need a signed DPA including these subprocessor terms, email privacy@erissa.ai and we will countersign ours.
Caan Consultancy Ltd, a company registered in England and Wales, company number 09178365. Registered office: Lytchett House, 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, Dorset BH16 6FA, United Kingdom. Erissa is a trading name of Caan Consultancy Ltd.
Contact us: privacy@erissa.ai for data requests and your rights, support@erissa.ai for general questions and complaints, and security@erissa.ai for responsible disclosure. We answer data requests within one month, as required by the UK GDPR and EU GDPR.