In short
- Active subprocessors are listed openly here.
- Providers that have not yet been selected are not shown as active subprocessors.
- Database, e-mail and image storage are launch blockers until provider, region and agreements are locked.
Current list
- Vercel: production hosting, serverless runtime, deployments and operational logs for the Smooth Catering application.
- Google Analytics: website analytics only after consent and only when NEXT_PUBLIC_GA_ID is configured.
- Stripe: SaaS billing, Stripe Connect onboarding and payment references only when Stripe features are enabled.
Launch blockers
- Production database provider and region must be locked before broad commercial launch and then added to this list.
- Production e-mail provider must be selected, security-reviewed and added before sending production e-mail through the platform.
- Image storage provider must be selected, security-reviewed and added before direct customer uploads are enabled.
Changes
When production provider, region or transfer mechanism is locked, this list must be updated before customer data is processed there. Restaurants should receive a reasonable opportunity to review material changes according to the DPA or customer agreement.