| Vercel (hosting) | Application hosting, edge delivery, analytics. The Compass app runs on Vercel serverless + static infrastructure. | Request metadata (IP, user agent, path), logs, error traces. No application database. | Global edge with US-based control plane (Vercel Inc., USA). View DPA → |
| Supabase (Postgres + Auth + Storage) | Primary database of record, authentication (email/password + Google/LinkedIn OAuth), file storage for project cover images. | Account data (email, name, role, plan), companies, invoices, assessment answers + reports, notifications, uploaded images. | Configurable per project; Stobox Compass hosts in the region selected at project creation (contact support for region). View DPA → |
| Stripe (payments) | Subscription and one-time payment processing, Stripe Hosted Checkout, Customer Portal, invoice + dispute webhook events. | Customer email, name, payment method tokens (card / bank data NEVER touches Stobox servers), billing address, purchase history. | United States (Stripe Inc.); EU-standard-contract-clauses in place via Stripe's DPA. View DPA → |
| Anthropic (AI report generation) | Generates the consulting-grade Readiness Report from a completed 25-question assessment. Called only after the user grants explicit in-product consent. | Assessment answers (business-sensitive: jurisdiction, regulator, raise target, legal counsel status, token structure, vendor choices). No personal identifiers are sent. | United States (Anthropic, PBC). Data is processed under Anthropic's commercial terms · it is not used to train their foundation models. View DPA → |
| Resend (transactional email) | Sends welcome emails, admin announcements, early-access notifications, and assessment-report email deliveries. | Recipient email address, name (if provided), message content. | United States (Resend Inc.). View DPA → |
| ipapi.co (geolocation) | Resolves caller IP to city / country for session + event analytics shown in the admin panel. | IP address. No other identifier is passed. | United Kingdom (ipapi). View DPA → |