Legal · subprocessors
The companies that process personal data on behalf of Klarora customers.
| Name | Task | Country | Transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Singapore (Supabase Pte. Ltd.) | Standard Contractual Clauses (Decision (EU) 2021/914) |
| Cloudflare | Hosting, edge network and agent runtime | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Amazon Web Services (via Supabase) | Infrastructure underneath Supabase | United States | EU-U.S. Data Privacy Framework |
| Stripe | Payments and billing | United States | Stripe Data Transfers Addendum |
| Anthropic | AI model provider | United States | Standard Contractual Clauses (Decision (EU) 2021/914), incorporated in its DPA; participates in the EU-U.S. Data Privacy Framework |
| OpenAI | AI model provider | United States (EEA contracting entity: OpenAI Ireland Limited) | Standard Contractual Clauses (Decision (EU) 2021/914), incorporated in its DPA |
| AI model provider and Google integrations | United States and Ireland (Google LLC, Google Ireland Limited) | Standard Contractual Clauses (Decision (EU) 2021/914), incorporated in the Cloud Data Processing Addendum |
We give customers 30 days' notice before a new subprocessor starts processing personal data. Customers can object during that period.