Subprocessors
Nomabase uses the following third-party subprocessors to deliver the platform. We maintain Data Processing Agreements with each Art. 28 Processor. Tenant-elected subprocessors are only activated when a tenant explicitly connects that integration.
For questions or to request a list of DPAs, contact legal@nomabase.io.
Core Infrastructure (9)
Always active. These subprocessors support the platform for all customers.
| Subprocessor | Purpose | Data Processed | Role |
|---|---|---|---|
| Anthropic | LLM inference (Messages API) | Agent conversations, business knowledge, PII in prompts | Art. 28 Processor |
| Supabase | Database, Auth, Storage, pgsodium | All tenant data, encrypted credentials | Art. 28 Processor |
| Vercel | Hosting nomabase.io | Web session data, server-side cookies | Art. 28 Processor |
| Cloudflare | Workers, R2, Custom Hostnames, DNS, Email Routing | Transit data, backup dumps, inbound email | Art. 28 Processor |
| MailChannels | Outbound email relay | Outbound email content, recipient addresses | Art. 28 Processor |
| Slack | OAuth, Events API, workspace message routing | Workspace metadata, message content | Art. 28 Processor |
| Sentry | Error monitoring | Stack traces, error context | Art. 28 Processor |
| PostHog | Internal analytics | Internal usage metrics | Controller (Nomabase internal) |
| Stripe | Billing | Payment method, subscription data | Art. 28 Processor |
Tenant-Elected Integrations (6)
Activated only when you connect the integration. Nomabase does not access these services unless you have explicitly authorized the connection.
| Subprocessor | Purpose | Data Processed | Role |
|---|---|---|---|
| OAuth (GBP, GCal), Google Business Profile API, Google Calendar API | Listing data, calendar events | Tenant-elected | |
| Intuit / QuickBooks | OAuth, QBO API (P&L, invoices, customers) | Financial data, customer lists | Tenant-elected |
| Mailchimp | Email marketing | Subscriber lists, campaign data | Tenant-elected |
| Calendly | Appointment booking | Appointment data, contact info | Tenant-elected |
| Acuity | Appointment booking | Appointment data, contact info | Tenant-elected |
| Meta / Instagrampending | Social and reviews (pending Meta approval) | Social posts, review content | Tenant-elected |
Planned Subprocessors (2)
Not yet active. These will be enabled before Nomabase enters its SOC 2 Type II audit window. This page will be updated before activation.
| Subprocessor | Purpose | Data Processed | Role |
|---|---|---|---|
| Langfuse / Braintrust / Arizeplanned | Agent observability | Agent trace data | Art. 28 Processor |
| Grafana Cloudplanned | System observability | Metrics, logs | Art. 28 Processor |
Change notifications
We will provide 30 days advance notice of material changes to this subprocessor list via email to the account owner. Customers with a signed DPA may object to new subprocessors per the terms of that agreement.