/subprocessors
Subprocessors
The vendors that may process SophionOS data, what each one does, and where it runs. Dodo Payments is the one exception: it is our merchant of record, so it decides how your payment data is processed rather than processing it on our instructions.
If you self-host, you choose your own processors. This page lists ours, not yours.
Last updated: October 20, 2026
Version 2.0 · effective October 19, 2026
Who these vendors are
Under India's DPDP Act, 2023 Taha Aalam, sole proprietor trading as SophionOS, is the Data Fiduciary and these vendors are our Data Processors; where the EU or UK GDPR applies, we are the controller and they are our processors. Each is bound by contract to process personal data only on our instructions and to apply security safeguards. This page lists who they are and why.
Dodo Payments is the exception. It is our merchant of record and the seller of record for paid plans and founding seats, so it decides how your payment data is processed rather than processing it on our instructions, and Dodo's own privacy policy applies to that data. See section 4.1 of the Privacy Policy.
SophionOS Cloud
| Vendor | Purpose | Data involved | Location |
|---|---|---|---|
| Clerk | Authentication, sessions, account identity | Email, name, profile image, user id, session records | United States |
| Supabase | Database and hosting | Your workspace content, settings, hashed API keys, billing metadata | United States |
| Vercel | Application hosting and delivery | Request data and logs in transit | United States / global edge |
| Dodo Payments | Subscription billing and the one-time founding-seat checkout; merchant of record, the seller of record, not a processor | Your name, email, and billing details at checkout, and the payment record. Card details go to Dodo, never to us. | United States / India |
| Resend | Transactional email delivery | Your email address and the content of the brief or notice being delivered | United States |
| Cron and job infrastructure | Scheduling of briefs and background jobs | Job payloads, which may include workspace identifiers | United States |
This website
This website, sophionos.com, runs on a smaller stack: Vercel for hosting, Supabase for the database, Resend for the emails we send you, and Dodo Payments for the founding-seat checkout. It also uses Google Analytics 4 for aggregate page-view analytics, and only after you accept the analytics consent banner. The Privacy Policy has the detail on what this site collects.
AI clients you connect
Anthropic (Claude), OpenAI (Codex), Cursor, Antigravity, OpenCode, and other MCP-compatible clients are not our processors. They are independent controllers acting for you. SophionOS does not call them; you configure them with an API key you create, and they process whatever they read under their own terms. We cannot instruct them, audit them, or delete data from them. See Data & AI.
Self-hosted SophionOS Core
If you self-host, you choose the processors. This page lists our choices, not yours. A self-hosted deployment typically uses:
- Your own Clerk application (or your identity provider of choice) for authentication.
- Your own Supabase/Postgres instance and your own hosting, in whatever region you configure.
- Your own email provider if you enable briefs.
- Any AI client your users connect.
Billing, Dodo Payments, and the SophionOS-managed Supabase and Vercel projects do not apply to your deployment.
Changes to this list
We add a vendor only when a feature needs it, and we update this page at the same time. If a change materially affects how your personal data is processed, we tell you by email before it takes effect, and you may object or delete your account first. To be notified of changes, or to raise an objection, write to privacy@sophionos.com.
This page is product documentation, not legal counsel.