Last updated: August 2, 2026 · Version 2.4
Sub-Processors
SOCSimulator LLC uses a small number of trusted third-party service providers ("sub-processors") to help deliver our service. This page lists the sub-processors that may process personal data, along with the purpose of each engagement, the categories of data involved, and the region in which processing takes place.
Sub-Processor Register
Each sub-processor below is engaged under a written contract that imposes data protection obligations no less protective than those we commit to in our Privacy Policy and Data Processing Addendum. We remain responsible for the processing our sub-processors carry out on our behalf.
Our basic cookieless pageview and event analytics run on a self-hosted Umami instance, so Umami is not an external sub-processor and receives no third-party data transfer. PostHog is the separate US-cloud processor for pseudonymous product events, pageviews, web vitals, sanitized errors, and diagnostic session replay sampled at roughly 25% of sessions, all under legitimate interest. That PostHog traffic reaches us through a managed reverse proxy on our own subdomain, so Cloudflare transmits and processes it in transit before it terminates in the same US PostHog project.
| Sub-processor | Purpose | Data categories | Location / Region | Docs |
|---|---|---|---|---|
| Supabase | Authentication and Postgres database (primary data store) | Account and profile data, training/assessment activity, authentication data | EU region | Privacy |
| Stripe | Payment processing and subscription billing | Billing details, transaction history, email address | United States / global | Privacy |
| Resend | Transactional and marketing email delivery | Email address, name, message content | United States | Privacy |
| Vercel | Application hosting and content delivery network (CDN) | IP address, request metadata, log data | United States / global | Privacy |
| Cloudflare | Bot and fraud prevention (Turnstile), edge network services, and the managed reverse proxy that carries product analytics traffic to PostHog | IP address, request metadata, challenge tokens. As the analytics proxy it also transmits, in transit, the PostHog payload described in the PostHog row below. | Global | Privacy |
| Upstash | IP-based rate limiting (abuse prevention) | IP address, request counters | United States / global | Privacy |
| PostHog | US-cloud product diagnostics: pseudonymous product events, pageviews, web vitals, sanitized errors, and input-masked diagnostic session replay sampled at roughly 25% of sessions — all under legitimate interest, with a separate objection control for replay | Pseudonymous account identifier, bounded product event data, sanitized error data, and a masked interaction sequence for sampled sessions. Replay excludes request headers, request/response bodies, browser console output, and canvas, and never covers assessment, sign-in, password, MFA, or billing pages. | United States (Virginia) | Privacy |
| Discord | Optional community integration: role sync and notifications for users who link their Discord account. Active only when you link Discord. | Discord user ID, Discord OAuth tokens, subscription tier/rank | United States / global | Privacy |
Changes to This List
We notify affected business customers of changes to our sub-processors at least 30 days before onboarding a new sub-processor, giving them the opportunity to object on reasonable data protection grounds before the new sub-processor begins processing. Details of the objection process are set out in our Data Processing Addendum.
More Information
For more detail on how we handle personal data, see our Privacy Policy and Data Processing Addendum. Questions about this register can be directed to support@socsimulator.com.
Our full legal identity and registered postal address are stated in the Privacy Policy's contact section and, for the purposes of the Standard Contractual Clauses, in Annex I of the DPA.