| Vendor | Purpose | Data class | Region | DPA | SOC 2 / Cert |
|---|
| Vercel Inc. | Static site + serverless hosting | Internal · Confidential (logs) | US (multi) | ✓ | SOC 2 Type II |
| Neon (Databricks) | Postgres database | Confidential | US-East | ✓ | SOC 2 Type II |
| Stripe Inc. | Payments · subscription billing | Payment metadata (cards tokenized) | US/EU | ✓ | SOC 2 Type II + PCI-DSS L1 |
| IONOS | Shared hosting (PHP/MySQL) | Confidential | DE/US | ✓ | ISO 27001 |
| Cloudflare | DNS · CDN · DDoS | Internal (logs) | Global | ✓ | SOC 2 Type II + ISO 27001 |
| GitHub (Microsoft) | Source control · CI/CD | Internal (code) | US | ✓ | SOC 2 Type II |
| HubSpot | CRM · marketing email | Confidential (contacts) | US | ✓ | SOC 2 Type II |
| Calendly | Scheduling | Confidential (calendar metadata) | US | ✓ | SOC 2 Type II |
| Anthropic (Claude API) | LLM inference (no member PII) | Internal · drafting | US | ✓ | SOC 2 Type I (Type II pending) |
| OpenAI | LLM inference (fallback) | Internal · no member PII | US | ✓ | SOC 2 Type II |
| Hostinger (n8n VPS) | Self-hosted automation | Internal | LT/EU | ✓ | ISO 27001 |