Subprocessors
Effective May 1, 2026A subprocessoris a third-party service Pulse uses to deliver the product on your behalf. The full list is below, kept current. We give 30 days’ advance notice before adding a new one, you can object and exit if you don’t agree (see our DPA, Clause 6).
Every subprocessor is bound by data-protection terms no less protective than the ones in our DPA, and every cross-border flow is covered by EU Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework.
| Subprocessor | Service | Region | Transfer mechanism |
|---|---|---|---|
| Vercel, Inc. | Application hosting and edge CDN Request metadata, application logs, static assets | US (global edge network) | SCCs · UK Addendum · DPF |
| Supabase, Inc. | Managed Postgres database, authentication storage All Customer Data at rest, including connector content and account records | US (AWS-hosted) | SCCs · UK Addendum · DPF |
| Anthropic, PBC | Large-language-model inference (no-training API terms) Prompt content per request. Not used for training; Anthropic may retain inputs briefly (up to 30 days) for abuse monitoring under its API terms. Zero-data-retention agreement planned, not yet signed | US | SCCs · UK Addendum · DPF |
| OpenAI, OpCo LLC | Model inference (embeddings + chat completions for GPT-5-family model-picker selections), live microphone audio for Pulse Voice sessions (Realtime API), and opt-in web-research (no-training API terms) Embedding inputs, prompt content (incl. retrieved workspace context), and voice-session audio per request. Not used for training; OpenAI may retain inputs briefly (up to 30 days) for abuse monitoring under its API terms. Zero-data-retention agreement planned, not yet signed | US | SCCs · UK Addendum · DPF |
| Resend, Inc. | Transactional email delivery Recipient address, subject, body for verification and notification emails | US | SCCs · UK Addendum · DPF |
| Google LLC | Google Forms/Sheets, the sales-pipeline view for inbound demo requests only (no Customer Data, no product data) Demo-request lead details a prospect submits on the book-a-demo form: name, work email, company, company size, website, optional remarks | US | SCCs · UK Addendum · DPF |
Infrastructure providers (sub-subprocessors)
Some subprocessors above are themselves built on cloud infrastructure (notably AWS, used by Supabase and indirectly by several model providers). We treat AWS as a sub-subprocessor and disclose it here for transparency. Pulse has no direct contractual relationship with AWS for Customer Data; the chain of custody is governed by each listed subprocessor’s own DPA with their infrastructure provider.
Subprocessors we do not use
We don’t use any of the following on this product:
- Third-party advertising networks or behavioral ad platforms
- Customer-data-platform vendors (Segment, Rudderstack, mParticle)
- Marketing-pixel or attribution trackers (Meta, TikTok, Google Ads)
- Heatmap or session-replay tools (Hotjar, FullStory, LogRocket)
How we evaluate new subprocessors
Before onboarding any new subprocessor we review their security posture (current SOC 2 Type II report, ISO 27001 certification, or equivalent), their data-protection terms, the data residency they offer, and the necessity of the service. The goal is the shortest possible chain that still lets Pulse work.
Notifications
To receive 30-day advance notice when this list changes, email support@pulsehq.tech with the subject “Subprocessor notifications”. We’ll add you to the notification list maintained for this purpose.
Contact
Questions about anything on this page: support@pulsehq.tech.