Sub-processors
Last updated: October 14, 2026
These providers process personal data in Grantboard workspaces on behalf of the organization that operates each workspace. They are the agreed list in Annex IV of our Data Processing Agreement.
Current sub-processors
Supabase
Supabase Pte. Ltd.
- Purpose
- Database, sign-in and file storage
- Location
- London, United Kingdom
- Transfers outside the EEA
- United Kingdom: European Commission adequacy decision. Any access by Supabase from other countries: standard contractual clauses in Supabase’s data processing addendum, part of its terms of service.
Vercel
Vercel Inc.
- Purpose
- Application hosting and content delivery
- Location
- Washington, D.C., United States, for the app; Vercel’s global network for delivery
- Transfers outside the EEA
- EU-US Data Privacy Framework: Vercel is certified. Vercel’s data processing addendum, which applies to our Pro plan, adds standard contractual clauses (Decision (EU) 2021/914).
Resend
Plus Five Five, Inc. (Resend)
- Purpose
- Sending email: sign-in links, invitations, notifications and reminders
- Location
- Ireland (European Union) for sending; United States for Resend’s other processing
- Transfers outside the EEA
- EU-US Data Privacy Framework, and standard contractual clauses in Resend’s data processing addendum, part of its terms of service.
Sentry
Functional Software, Inc. (Sentry)
- Purpose
- Error monitoring and a 10% sample of performance traces, never from sign-in or grantee portal pages, configured not to collect default personal data
- Location
- Frankfurt, Germany (Sentry’s EU data region)
- Transfers outside the EEA
- Stored in the European Union. Any access by Sentry from the United States: EU-US Data Privacy Framework, under which Sentry is certified, with standard contractual clauses (Decision (EU) 2021/914) in Sentry’s data processing addendum as the fallback.
Upstash
Upstash, Inc.
- Purpose
- Rate limiting to protect the service from abuse
- Location
- Frankfurt, Germany
- Transfers outside the EEA
- Stored in the European Union. Any access by Upstash from the United States: EU-US Data Privacy Framework, with standard contractual clauses in Upstash’s data processing addendum, part of its terms, as the fallback.
Proton
Proton AG
- Purpose
- Our support mailbox, hello@grantboard.co, including spreadsheets sent to us for setup help
- Location
- Switzerland, Germany or Norway
- Transfers outside the EEA
- Switzerland: European Commission adequacy decision. Germany and Norway are in the European Economic Area.
| Provider | Purpose | Location | Transfers outside the EEA |
|---|---|---|---|
| SupabaseSupabase Pte. Ltd. | Database, sign-in and file storage | London, United Kingdom | United Kingdom: European Commission adequacy decision. Any access by Supabase from other countries: standard contractual clauses in Supabase’s data processing addendum, part of its terms of service. |
| VercelVercel Inc. | Application hosting and content delivery | Washington, D.C., United States, for the app; Vercel’s global network for delivery | EU-US Data Privacy Framework: Vercel is certified. Vercel’s data processing addendum, which applies to our Pro plan, adds standard contractual clauses (Decision (EU) 2021/914). |
| ResendPlus Five Five, Inc. (Resend) | Sending email: sign-in links, invitations, notifications and reminders | Ireland (European Union) for sending; United States for Resend’s other processing | EU-US Data Privacy Framework, and standard contractual clauses in Resend’s data processing addendum, part of its terms of service. |
| SentryFunctional Software, Inc. (Sentry) | Error monitoring and a 10% sample of performance traces, never from sign-in or grantee portal pages, configured not to collect default personal data | Frankfurt, Germany (Sentry’s EU data region) | Stored in the European Union. Any access by Sentry from the United States: EU-US Data Privacy Framework, under which Sentry is certified, with standard contractual clauses (Decision (EU) 2021/914) in Sentry’s data processing addendum as the fallback. |
| UpstashUpstash, Inc. | Rate limiting to protect the service from abuse | Frankfurt, Germany | Stored in the European Union. Any access by Upstash from the United States: EU-US Data Privacy Framework, with standard contractual clauses in Upstash’s data processing addendum, part of its terms, as the fallback. |
| ProtonProton AG | Our support mailbox, hello@grantboard.co, including spreadsheets sent to us for setup help | Switzerland, Germany or Norway | Switzerland: European Commission adequacy decision. Germany and Norway are in the European Economic Area. |
Upcoming changes
No changes are scheduled.
Change history
- October 14, 2026. We published this list with our Data Processing Agreement.
Public blockchain services
If a workspace uses the optional crypto features, Grantboard reads public blockchain data about the wallet and Safe addresses it enters, from the Safe Transaction Service (api.safe.global) and public RPC endpoints, mainly PublicNode (publicnode.com) with other public endpoints as fallbacks. These services receive the public address being looked up from our servers. Public wallet addresses can still be personal data.
Objections and questions
To object to a change, write to hello@grantboard.co before it takes effect. The services we use for our own purposes, such as billing, are listed in our Privacy Policy.