Sub-processor list.
Omie acts as a data processor on behalf of customers (Controllers under GDPR). The table below lists every third party we share customer data with, how, and under what legal transfer mechanism. This list is updated whenever we add or retire a sub-processor. Subscribe below to receive 30 days’ advance notice before any addition.
| Sub-processor | Purpose | Data shared | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Postgres database, authentication, and file storage | Account, learning signals, and content you create | EU region available | EU region, SCCs 2021/914 otherwise |
| Vercel | Application hosting and edge delivery | Request metadata, no learning content stored at rest | Global edge, US control plane | SCCs 2021/914 |
| Anthropic | Ada, the AI coach, and content generation | Prompts and lesson context, not used to train foundation models | United States | SCCs 2021/914 |
| Resend | Transactional email such as magic links and digests | Name and email address | US and EU | SCCs 2021/914 |
| Stripe | Billing and subscriptions | Billing details, handled inside Stripe (PCI DSS) | Global | SCCs 2021/914 |
| PostHog | Product analytics | Pseudonymous usage events, never learning answers | EU cloud available | EU cloud, SCCs 2021/914 otherwise |
| Sentry | Error monitoring, so we catch failures before you report them | Error traces and request metadata, never learning answers | US, EU available | SCCs 2021/914 |
Last reviewed 15 August 2026. Transfers outside the EEA rely on the Standard Contractual Clauses approved by EU Commission Implementing Decision 2021/914, Module 2, which are incorporated into our Data Processing Agreement. The same seven processors are described in plain language on our security page.
Article 28 GDPR gives you the right to object before we add a new sub-processor. Subscribe below and we’ll email you at least 30 days in advance.