Last updated: October 18, 2026
Draft schedule — pending counsel sign-off
Regions and vendor terms below are operational candidates for counsel verification. This list is not a final contractual schedule until counsel confirms DPAs/SCCs and change-notice mechanics. See the draft Customer DPA.
Case Studio uses the following subprocessors to operate Visa Engine for firm and consumer customers. This page is intended to support Art. 28 transparency. Full draft processor terms live on the DPA page; the Privacy Policy and Security pages describe how we handle personal data more generally.
| Subprocessor | Service | Typical region | Personal data |
|---|---|---|---|
| Amazon Web Services | Hosting, compute, database and auth (self-hosted Supabase), file storage, backups; AI model inference on Amazon Bedrock (Anthropic Claude models) | eu-west-2 (London), backup copies in eu-west-1 (Ireland); Bedrock: AWS EU Regions | Account, case, documents, backups; prompts, document text, AI outputs |
| OpenAI, L.L.C. | Model inference / embeddings | US (confirm) | Prompts, document text, outputs |
| Anthropic, PBC | Model inference (Claude models through Anthropic's own API) | US (confirm) | Prompts, document text, outputs |
| Stripe, Inc. | Subscription billing | US / local entities | Billing identifiers, Customer user contacts as needed |
| PostHog, Inc. | Product analytics, errors, session replay | EU Cloud (configured) | Usage events; possible UI content in replay |
| Google LLC | OAuth sign-in | US / global | Name, email, profile photo |
| Apple Inc. | Sign in with Apple | US / global | Name (first sign-in only), email or Apple relay address |
| Resend, Inc. | Transactional email (sign-in codes, team invites, signature requests, privacy-request notices) | US (confirm) | Name, email address, sign-in code, invite / request details |
Case Studio intends to notify Customer at least [30] days before adding or replacing a subprocessor, except for emergency security replacements with prompt notice. Customer may object in writing on reasonable data-protection grounds; unresolved objection and termination rights are for counsel to finalize in the DPA.