This page lists the third-party services (sub-processors) that Blend Technologies engages to help deliver the platform. Each is bound by a written data processing agreement. We give clients advance notice of any change to this list.
| Processor | Purpose | Data categories | Region | Transfer mechanism | DPF-certified? |
|---|---|---|---|---|---|
| Vercel | Webapp hosting (frontend, serverless functions, quiz builder, merchant dashboard, auth) | Merchant account data; end-user quiz submissions | EU (fra1 Frankfurt) | N/A (EU processing region) | N/A |
| Supabase | Database + auth; stores end-user quiz data | End-user quiz submissions (health data, identifiers, consent); merchant account data | EU (eu-west-1 Ireland) | N/A (EU processor) | N/A |
| Render — personalisation | FastAPI personalisation engine hosting | End-user quiz submissions; pseudonymised logs (90-day retention) | EU (Frankfurt) | N/A (EU processor) | N/A |
| Render — checkout | Billing service hosting | Merchant billing data only | EU (Frankfurt) | N/A (EU) | N/A |
| Stripe | Payment processing (merchant billing, not end-customer) | Merchant billing data | US / Ireland | EU-US DPF | Yes — EU-US DPF, UK Extension, Swiss-US DPF |
| Resend | Transactional email (auth, password resets, quiz results) | Email addresses, recipient names, email content | US | UK IDTA / EU SCCs 2021/914 | Yes per Resend DPA (verify on gov registry) |
| Shopify | Source of merchant catalogue and order data (analytics only, no customer PII) | Product catalogue, order IDs, timestamps, cart events | Multi-region | Per Shopify DPA | Per Shopify |
EU-US Data Privacy Framework certifications must be verified annually at dataprivacyframework.gov. This list is reviewed quarterly.