Subprocessors
Last updated 21 August 2026
The exact subprocessor boundary for a customer engagement is confirmed in the signed order and data-processing agreement. A service is used only where it is required for the agreed scope.
Core service providers
- Vercel: application hosting, content delivery, deployment security and, only after website consent, aggregated analytics and performance measurement.
- Supabase: managed PostgreSQL database, authentication and tenant-controlled application records.
- Resend: transactional email delivery, including website acknowledgements and authorised workspace invitations.
- Microsoft: business email, customer correspondence and scheduling through Microsoft 365 and Bookings.
- Stripe: invoicing and payment processing when electronic payment is enabled for the relevant customer.
Optional AI interpretation
External AI interpretation is disabled unless it is enabled for the engagement and an authorised customer user expressly approves it for that individual analysis run. Where approved, QAI sends a minimised package of calculated facts, trends, evidence statements and verification gaps through Vercel AI Gateway to OpenAI. Raw source files, direct record identifiers and contact details are not included in that package. The governed calculation, source references, customer approvals and official quality record remain authoritative.
Change and questions
Material changes are notified according to the applicable DPA. For current regions, transfer safeguards or a customer-specific list, email security@qaitransformation.com.