Legal
Data Use & Subprocessors
Last updated: September 16, 2026
Draft pending legal review
This document is a working draft. Final language is subject to attorney review prior to launch. Questions? Email legal@successionstack.com.
This document describes how SuccessionStack processes Customer Data and the third-party subprocessors we rely on to deliver the Service. It supplements our Privacy Policy and the Data Processing Addendum available on request.
Marketing-site subprocessors
The SuccessionStack marketing website (successionstack.com) uses a minimal set of providers:
| Subprocessor | Purpose | Data handled |
|---|---|---|
| Vercel | Hosting and CDN; also Vercel Analytics and Speed Insights, which only run if you allow analytics | Page views and page-performance measurements, IP address (cookieless or hashed) |
| Resend | Transactional and nurture emails | Email address, name (if provided) |
| AgentMail | Delivering contact and demo enquiries to us | Everything you put in the form: name, email, company, team size and your message |
| Web3Forms | Delivering walkthrough booking requests | Name, work email, company, team size, what you want to cover, and your preferred times |
| PostHog | Product analytics, heatmaps and session replay | Page views, clicks, approximate location, device and browser, and a session replay with form fields masked. When you submit a form we also send the form contents — including your message — and we use your email address as the identifier for your activity on the site. |
Product-app subprocessors
The SuccessionStack product (www.successionstack.com) relies on a separate set of subprocessors:
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting | US East (configurable on request) |
| Supabase | Postgres database, authentication, file storage | US East default; EU available for enterprise |
| Anthropic | AI features (Copilot, What-If Narration, PDF Review) | US — input only, no training on Customer Data |
| Resend | Transactional emails (review reminders, alerts) | US |
| PostHog | Product analytics (PII-redacted event stream, text-masked replay) | US |
How we handle Customer Data
- Encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Isolated per tenant via row-level security in Postgres.
- AI inputs are not retained by Anthropic and are not used for model training.
- Backups are encrypted and retained for 90 days, then permanently deleted.
- Staff access requires an administrator to grant time-boxed support access inside the product, and every such session is written to the customer's own activity log.
Changes to subprocessors
We notify customers at least 30 days before adding or replacing a subprocessor that processes Customer Data. Customers may object on reasonable grounds.
Data Processing Addendum
Our standard DPA includes GDPR-compliant Standard Contractual Clauses. Request a copy at legal@successionstack.com. We also accept customer-supplied DPAs after legal review.