Aunory Subprocessors

These are the companies that process data on Aunory's behalf. "Processes" is meant literally — each one below can see something, and the point of this page is to say exactly what, rather than to publish a reassuring list of logos.

---

The ones that hold your data

Supabase — database, authentication, file storage

Everything. Account identities and password hashes, every profile field, every analysis, signal and briefing, and the full synced roster including member names, email addresses and phone numbers. Also holds the private bucket that uploaded files are mirrored to.

One qualification in our favour: files in that bucket are encrypted by us before upload, with a key that never leaves our hosting provider, so a breach of the bucket alone yields unreadable bytes. The database rows are not encrypted that way — only ten specific columns are.

Backups retain deleted rows until the backup window rolls over.

Render — application hosting

Runs the API and the scheduled jobs. Holds the persistent disk that uploaded files are written to (encrypted), the encryption key itself, and all application logs. Log contents have contact details and session tokens redacted going forward; historical logs expire on Render's schedule.

Anthropic — the AI that does the analysis

Receives business data, including personal data inside it. Being specific, because this is the one most likely to surprise someone:

• Ask Aunory sends the question, dataset structure, aggregate statistics, and up to ten raw example rows, which may contain every personal column in the file.
• PDF upload sends the entire document, base64-encoded.
• Briefings send the business name, health score, signal and action titles, and a summary excerpt.
• Draft-message sends the selected person's name, the amount at risk, and the reason.

Anthropic's API terms state that inputs and outputs are not used to train their models, and document automatic deletion of standard API inputs and outputs within 30 days subject to their exceptions. That is a different, stronger policy than their consumer chat products; Aunory only ever calls the API.

There is no per-request deletion operation, so deleting an Aunory account stops future sends but cannot retract requests already made.

Zen Planner / Daxko — the source system

Not a recipient so much as an origin: if you connect it, we pull member names, emails, phones, attendance, memberships and class data from your account. We do not pull payment or transaction records.

Writes back to your Zen Planner are consent-gated and, where they run unattended, governed by a rule you set yourself.

Related and worth naming separately: HighLevel / LeadConnector. Zen Planner Engage is Daxko's white-label of that platform, and our client calls services.leadconnectorhq.com directly. Lead contact details and any notes written back pass through it.

Twilio SendGrid — email delivery

Receives your account email address for every message we send you: briefings, alerts, password resets. Alert emails can contain a member's name in the subject or body, so SendGrid sees personal data from your business data, not just your own address.

For lead outreach, it also receives the recipient's address and the message body.

On account deletion we submit your address to SendGrid's recipient erasure endpoint. That does not remove Email Activity records, which expire under SendGrid's own retention.

---

The ones that hold less than you might think

Stripe — payments

Receives your email address and your Aunory user id as metadata, and returns a customer id, which is the only thing we store. Checkout is hosted by Stripe, so card details never reach Aunory at all. No member or business data goes to Stripe.

On deletion we delete the customer object. Stripe retains transaction, invoice, dispute and tax records for its own legal obligations — that is customer-object deletion, not erasure of payment history.

Sentry — error reporting

Configured not to receive user identities: send_default_pii=False and include_local_variables=False on the backend, and the browser client deletes the user object and redacts emails, phone numbers and tokens before sending.

Stated honestly: the backend does not yet scrub exception message text, breadcrumbs or performance-span data, so a personal value quoted inside an error message could reach Sentry. We are fixing it.

Cloudflare — serves the website

Serves the frontend and terminates TLS, so it sees request metadata — IP address, user agent — for every visitor. No application data passes through it: the browser talks to our API and database directly.

GitHub — source code and automation

Holds the source code and runs our build and deployment automation. Scheduled jobs trigger our API with a shared secret and carry no customer data in the request. The daily production smoke test creates and deletes its own throwaway account rather than touching a real one.

Our operations alert channel

Failure alerts are delivered to a Slack or Discord webhook. Payloads carry event names, counts and account ids — no names, addresses or content, and values are redacted for contact details on the way in. Named here because a chat workspace receiving account identifiers is a processor even though it is not a product we bought.

---

How to read a change to this page

A new subprocessor gets added here before it starts processing, not after. If you have a contract with us that requires notice of subprocessor changes, that notice is the change history of this page.