Skip to main content

Last updated: August 2, 2026 · Version 2.4

Sub-Processors

SOCSimulator LLC uses a small number of trusted third-party service providers ("sub-processors") to help deliver our service. This page lists the sub-processors that may process personal data, along with the purpose of each engagement, the categories of data involved, and the region in which processing takes place.

Sub-Processor Register

Each sub-processor below is engaged under a written contract that imposes data protection obligations no less protective than those we commit to in our Privacy Policy and Data Processing Addendum. We remain responsible for the processing our sub-processors carry out on our behalf.

Our basic cookieless pageview and event analytics run on a self-hosted Umami instance, so Umami is not an external sub-processor and receives no third-party data transfer. PostHog is the separate US-cloud processor for pseudonymous product events, pageviews, web vitals, sanitized errors, and diagnostic session replay sampled at roughly 25% of sessions, all under legitimate interest. That PostHog traffic reaches us through a managed reverse proxy on our own subdomain, so Cloudflare transmits and processes it in transit before it terminates in the same US PostHog project.

Sub-processorPurposeData categoriesLocation / RegionDocs
SupabaseAuthentication and Postgres database (primary data store)Account and profile data, training/assessment activity, authentication dataEU regionPrivacy
StripePayment processing and subscription billingBilling details, transaction history, email addressUnited States / globalPrivacy
ResendTransactional and marketing email deliveryEmail address, name, message contentUnited StatesPrivacy
VercelApplication hosting and content delivery network (CDN)IP address, request metadata, log dataUnited States / globalPrivacy
CloudflareBot and fraud prevention (Turnstile), edge network services, and the managed reverse proxy that carries product analytics traffic to PostHogIP address, request metadata, challenge tokens. As the analytics proxy it also transmits, in transit, the PostHog payload described in the PostHog row below.GlobalPrivacy
UpstashIP-based rate limiting (abuse prevention)IP address, request countersUnited States / globalPrivacy
PostHogUS-cloud product diagnostics: pseudonymous product events, pageviews, web vitals, sanitized errors, and input-masked diagnostic session replay sampled at roughly 25% of sessions — all under legitimate interest, with a separate objection control for replayPseudonymous account identifier, bounded product event data, sanitized error data, and a masked interaction sequence for sampled sessions. Replay excludes request headers, request/response bodies, browser console output, and canvas, and never covers assessment, sign-in, password, MFA, or billing pages.United States (Virginia)Privacy
DiscordOptional community integration: role sync and notifications for users who link their Discord account. Active only when you link Discord.Discord user ID, Discord OAuth tokens, subscription tier/rankUnited States / globalPrivacy

Changes to This List

We notify affected business customers of changes to our sub-processors at least 30 days before onboarding a new sub-processor, giving them the opportunity to object on reasonable data protection grounds before the new sub-processor begins processing. Details of the objection process are set out in our Data Processing Addendum.

More Information

For more detail on how we handle personal data, see our Privacy Policy and Data Processing Addendum. Questions about this register can be directed to support@socsimulator.com.

Our full legal identity and registered postal address are stated in the Privacy Policy's contact section and, for the purposes of the Standard Contractual Clauses, in Annex I of the DPA.