This page lists the third parties that process personal data on Habivista's behalf. We update it before adding any new sub-processor. Customers under our Data Processing Addendum are notified by email at least thirty days in advance of changes.

Infrastructure

Vercel Inc. — application hosting, edge network. Region: USA & EU. Data: account & activity data.
Neon Inc. — managed PostgreSQL database. Region: EU (West London). Data: full application database.
Cloudflare, Inc. — DNS, DDoS protection, image delivery. Region: global edge. Data: request metadata, uploaded media.

Communications

Resend Inc. — transactional email delivery. Region: USA. Data: recipient email, subject, body.
Twilio Inc. — SMS for OTP and transactional alerts. Region: USA. Data: recipient phone, message body.

Payments

Stripe Inc. — card payments, subscription billing. Region: USA & Ireland. Data: payment metadata; card numbers handled by Stripe directly under PCI-DSS.

Capture & media

Matterport, Inc. — 3D tour hosting and embedded viewing. Region: USA. Data: tour scans, viewer analytics.

Analytics & monitoring

Vercel Analytics — privacy-preserving aggregate site analytics. No cross-site profiling.
Sentry, Inc. — error monitoring. Region: USA & EU. Data: error stack traces, request paths.

Notification of changes

This list is reviewed at least quarterly. Changes are announced by email to all account holders at least thirty days before they take effect for Customers under the DPA, and at least fourteen days before they take effect for end users where required by Act 843.

Sub-processors list