Subprocessors
Last updated September 27, 2026
The short version
- Nine companies help run Cortado, all of them in the United States.
- Five are always involved: Supabase, Vercel, Resend, Backblaze, Apple (iCloud Drive).
- The other four only see anything when you use the feature they power.
- We email you at least 14 days before adding one.
This box is a summary, not the agreement. Everything below it is.
A subprocessor is a company we rely on that stores or handles data you put into Cortado. This is the complete list. Two of them, Backblaze and Apple, hold only encrypted backups they have no key to open.
| Company | What for | What they see | Where | When |
|---|---|---|---|---|
| Supabase | Database | Everything stored in the app, encrypted at rest | United States | Always |
| Vercel | Hosting the website and app | Requests as they pass through, and cookieless page-view counts on the public site | United States | Always |
| Resend | Sending email | Your email address and the email itself | United States | Always |
| Backblaze | Off-site backups | Encrypted backup files it has no key to read | United States | Always |
| Apple (iCloud Drive) | A second copy of the encrypted backups | Encrypted backup files it has no key to read | United States | Always |
| Anthropic | The AI features | Only what one request contains, such as the invoice you asked it to read | United States | Only when you use an AI feature |
| Stripe | Taking payment | Your name, email and card. The card goes only to Stripe | United States | If you subscribe |
| Calendar sync | The shifts you choose to put on the calendar, and the calendar account's email address | United States | If you connect Google Calendar | |
| Square | POS sync | Cortado reads your completed orders and menu from Square and writes nothing back | United States | If you connect Square |
Not on the list, and why
- Toast and Clover. Cortado reads their sales exports when you upload one. It never connects to them, so they never receive anything from us.
- Your suppliers. Cortado builds your order and links to each supplier's own ordering page or contact details. You place the order yourself, so nothing goes to them from us.
- Anyone selling ads or analytics. There are none. Page views on the public site are counted by Vercel without cookies.
Changes
Before a new subprocessor handles your data, we update this page and email the owner of every account at least 14 days ahead. If you object, the data processing addendum explains what happens next.
Questions about any of this? Email sen@cortado.services and a person will answer.