Sub-processors
Last updated: 22 August 2026.
We use a small number of vetted third-party providers ("sub-processors") to run SortedResearch. Each is bound by data protection obligations no less protective than those in our Data Processing Agreement, and we remain responsible for their performance.
We will provide at least 30 days' notice before adding or replacing a sub-processor, by email or by updating this page. If you reasonably object on data protection grounds, we will work in good faith to resolve it, as set out in the DPA.
Current sub-processors
| Sub-processor | Purpose | Personal data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication, hosting | All platform data, including account and participant study data | US |
| Vercel | Application hosting and delivery | All data in transit through the application; privacy-respecting page analytics | US |
| Anthropic | Powers the Graham AI assistant and AI features | Graham conversations and the study data Graham analyzes | US |
| Stripe | Payment processing | Billing details; full card numbers never touch our systems | US |
| Resend | Transactional and support email | Email addresses and message content | US |
| Cloudflare | Bot protection (Turnstile) and encrypted off-site backup storage (R2) | Browser signals for bot checks; encrypted database backups | US |
| PureSpectrum | Optional panel recruitment marketplace | Only for studies where you purchase panel respondents: session outcomes keyed to the panel's own opaque transaction identifier, never names or contact details | US |
| Website analytics (Google Analytics 4) and advertising measurement (Google Ads) | Only with the visitor's consent to non-essential cookies: pages viewed, referral source, and ad-to-signup measurement on our marketing site and researcher app. Never on participant survey pages | US | |
| Microsoft | Advertising measurement on Bing and the Microsoft Advertising network (UET tag) | Only with the visitor's consent to non-essential cookies: pages viewed, referral source, and ad-to-signup measurement on our marketing site and researcher app. Never on participant survey pages | US |
International transfers to these sub-processors (EEA/UK/Switzerland → US) are covered by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
Notes on roles
- Anthropic processes Graham conversations to generate responses. Under Anthropic's commercial terms, API inputs and outputs are not used to train Anthropic's models.
- PureSpectrum operates its own respondent panel as an independent business. When you recruit through the managed panel, PureSpectrum sends participants to your study and receives back only the outcome of each session (completed, screened out, quota full, or removed for quality), referenced by its own transaction code, so it can credit or replace the respondent.
Staying informed
To be notified of sub-processor changes, email privacy@sortedresearch.com with the subject "Sub-processor updates" and we will add you to the notice list.