Last updated: September 12, 2026
Draft schedule — pending counsel sign-off
Regions and vendor terms below are operational candidates for counsel verification. This list is not a final contractual schedule until counsel confirms DPAs/SCCs and change-notice mechanics. See the draft Customer DPA.
Case Studio uses the following subprocessors to operate Visa Engine for firm and consumer customers. This page is intended to support Art. 28 transparency. Full draft processor terms live on the DPA page; the Privacy Policy and Security pages describe how we handle personal data more generally.
| Subprocessor | Service | Typical region | Personal data |
|---|---|---|---|
| Supabase, Inc. / self-hosted Supabase on AWS | Auth, database, file storage | US / EU (confirm per environment) | Account, case, documents |
| Amazon Web Services | Production compute, storage, backups (apex) | e.g. eu-west-2 (confirm) | Application data, backups |
| OpenAI, L.L.C. | Model inference / embeddings | US (confirm) | Prompts, document text, outputs |
| Vercel Inc. | Dev/preview hosting, analytics tooling | US / edge | Account/usage as applicable |
| Stripe, Inc. | Subscription billing | US / local entities | Billing identifiers, Customer user contacts as needed |
| PostHog, Inc. | Product analytics, errors, session replay | EU Cloud (configured) | Usage events; possible UI content in replay |
| Google LLC | OAuth sign-in | US / global | Name, email, profile photo |
Case Studio intends to notify Customer at least [30] days before adding or replacing a subprocessor, except for emergency security replacements with prompt notice. Customer may object in writing on reasonable data-protection grounds; unresolved objection and termination rights are for counsel to finalize in the DPA.