Sub-processors

Last updated: June 2026

These providers process personal data on our behalf to operate FillOnce. They are bound by confidentiality and data-processing terms. Optional services are only used when you or we enable them in configuration.

• Supabase

  Authentication, Postgres database, row-level security, file storage

  Region: Canada (ca-central-1)

  https://supabase.com

• Vercel

  Application hosting, TLS termination, serverless API routes, cookieless Web Analytics

  Region: Edge regions per deployment

  https://vercel.com

• Stripe

  Subscription billing and customer portal (when you enable paid plans)

  Region: Stripe infrastructure

  https://stripe.com

• Sentry

  Error monitoring (optional; no vault values in payloads when configured)

  Region: Sentry project region

  https://sentry.io

• Plausible Analytics

  Privacy-first, cookieless page analytics (optional)

  Region: EU

  https://plausible.io

• PostHog

  Cookieless product analytics (feature funnels; event names only, no vault data, no stored device identifier)

  Region: United States

  https://posthog.com

• Google Tag Manager

  Optional traffic analytics, unlike the cookieless tools above, this sets real cookies and only loads if you explicitly accept it in the cookie banner (see /cookies). Off by default; rejecting or ignoring the banner keeps it off with no effect on the product.

  Region: United States

  https://marketingplatform.google.com/about/tag-manager/

• Resend

  Transactional email (confirmation and support messages; processes your email address)

  Region: United States

  https://resend.com

• Cloudflare Turnstile

  Bot protection on sign-up and login (processes IP address and browser challenge data)

  Region: Global (Cloudflare network)

  https://www.cloudflare.com

• Fly.io (document conversion sidecar)

  LibreOffice conversion service for Word → PDF. Used only when you start a conversion: your browser decrypts the document and the plaintext file and its filename are sent to be converted, then the result is returned. Neither copy is retained; the filename is recorded in your audit log.

  Region: United States (Fly.io iad)

  https://fly.io

• FillOnce extraction & matching service (self-hosted by FillOnce)

  OCR / layout extraction for scanned or flat documents, and semantic field-label matching. Runs on FillOnce's own Fly.io infrastructure, not a third-party AI API. Extraction receives document bytes transiently to detect fields (not retained); semantic matching receives only a field's label text and candidate key names, never a saved vault value.

  Region: United States (Fly.io)

  https://fly.io

See also Privacy Policy.