Subprocessor List
Last updated: October 2, 2026
To deliver DOVAmfg, we use a small number of trusted third-party service providers ("subprocessors"). Each one has its own security posture and privacy commitments, reviewed before we onboarded them.
If we add, remove, or change a subprocessor, we update this page and change the date at the top. Enterprise customers under a signed Data Processing Agreement also receive 30 days' advance notice by email.
Current subprocessors
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Supabase | Managed PostgreSQL database, authentication, and file storage | Account data, production records, user credentials (hashed) | Canada — Montréal, AWS ca-central-1 |
| Vercel | Application hosting, deployment, and edge network | HTTP request metadata, deployment logs | United States / global edge |
| Stripe | Payment processing and billing | Billing contact, payment method, invoice history | United States / global |
| Resend | Transactional email delivery | Recipient email addresses, email content, delivery logs | United States |
| Sentry | Error tracking: tells us when the application breaks so we can fix it | Technical error details (error message, code location, browser and page address). Names, emails, cookies and form contents are removed before sending | United States |
| Google Drive / Sheets schedule-file sync, only for customers who connect it | OAuth access tokens, contents of connected schedule files | United States | |
| Google Ads | Advertising measurement on the public website only: tells us which of our Google ads brought a visitor who booked a demo. Loads only after the visitor accepts the cookie banner; never inside the application | Ad-click identifier and a cookie set by Google, page address, browser details. No names, emails or account data | United States |
| Cal.com | Demo booking calendar embedded on dovamfg.com/demo and linked from the contact page | Name, email, phone and notes the visitor types when booking a demo; chosen time | United States |
| Microsoft | SharePoint / OneDrive schedule-file sync via Microsoft Graph, only for customers who connect it | OAuth access tokens, contents of connected schedule files | United States / customer tenant region |
How to request advance notification
Enterprise customers under a Data Processing Agreement automatically receive 30 days' notice when we intend to add a new subprocessor. To request a signed DPA or to subscribe to subprocessor updates, email legal@dovamfg.com.
For the countersigned enterprise version of this document, or to ask a legal question, email legal@dovamfg.com. We respond within two business days.