Trust & compliance
Subprocessors
These are the third-party service providers that may process Demohub customer data. Each has signed a Data Processing Agreement with Demohub and meets industry-standard security controls.
| Provider | Purpose | Data location | Certifications |
|---|---|---|---|
| Vercel, Inc. Privacy |
Application hosting, edge functions, CDN | USA (US-West / IAD) | SOC 2 Type 2, ISO 27001, GDPR |
| Supabase, Inc. Privacy |
Postgres database, authentication, file storage | USA (US-West) | SOC 2 Type 2, HIPAA-eligible |
| Cloudflare, Inc. Privacy |
DNS, CDN, DDoS protection, TLS termination | Global edge | SOC 2 Type 2, ISO 27001, PCI DSS |
| Stripe, Inc. Privacy |
Payment processing, subscription billing, payouts | USA | PCI DSS Level 1, SOC 2 Type 2 |
| Resend, Inc. Privacy |
Transactional and notification email delivery | USA | SOC 2 Type 2, GDPR |
| PostHog, Inc. Privacy |
Product analytics, session replay (PII-masked) | USA (US Cloud) | SOC 2 Type 2, GDPR, HIPAA-eligible |
| GitHub, Inc. Privacy |
Source code hosting (no customer data) | USA | SOC 2 Type 2, ISO 27001 |
We notify customers of subprocessor changes via email at least 14 days in advance. To receive notifications, email david@demohubhq.com.
Last updated: June 25, 2026