The boring bits
Subprocessors
These are the services named in the current architecture or supported by code. The table separates the stated hosted setup from unconfirmed settings and future services. Regions and contracts still need verification before business reliance.
Last updated: 25 October 2026
Draft · not yet reviewed by a lawyer
Provider register
For customer workspace data, these services may act as subprocessors. Some also act as independent controllers for their own account/security data. This is a draft register, not an assertion that contracts are already signed.
| Service / status | Purpose and data | Region / open item |
|---|---|---|
| Vercel · stated hosting | Serves site/app; requests, IP/browser metadata, server logs and app data transiting functions. | US/global infrastructure; function, edge and log locations unknown, needs Yash. |
| Supabase · stated hosted storage | Postgres account/workspace/guide records and object-storage screenshots. Custom app authentication; use of Supabase Auth not found. | Seoul, South Korea per founder brief. Backup, replica and support access locations need confirmation. |
| OpenRouter · stated AI gateway | Screenshot and limited guide/step context; outputs and request metadata. | US/global; account retention/training controls, contract and actual route unknown, needs Yash. |
| Google Gemini / underlying serving provider · intended model route | Model inference on screenshots and step context, generated copy and safety processing. | Actual OpenRouter serving endpoint, processing region and applicable terms unknown, needs Yash. |
| Other configured AI writers · supported by code, activation unconfirmed | The code can send the same input to Anthropic or an OpenAI-compatible writer, including as fallback. | Do not enable additional providers until listed by legal entity, route, region and terms. Current live fallback settings unknown, needs Yash. |
| Domain registrar / DNS · provider unconfirmed | Domain administration and DNS queries; may receive contact and network metadata, not a guide-content feed by design. | Provider/legal entity and region unknown, needs Yash. |
| Email mailbox · provider unconfirmed | Mail you choose to send, sender address and support attachments. | Provider, mailbox existence and region unknown, needs Yash. |
| Transactional / marketing email · future | No mailing-list delivery or magic-link email integration is implemented in the inspected flow. | No provider appointed by this notice. Update before activation. |
Terms, transfers and changes
For AI details and checked primary sources, see AI Use & Data. General provider references: Vercel DPA and Supabase DPA. Their availability does not prove that Asterly has accepted the right terms. Transfer safeguards for Seoul, India, US and any onward processing remain [confirm with counsel].
The proposed B2B process gives 30 days’ notice before a material subprocessor change and a way to object on reasonable data-protection grounds. That process and its notification list are not operational yet; agree them in a signed DPA. Ask hello@asterly.co for clarification before uploading restricted data.