Coreframes Lab uses a limited number of third-party subprocessors to deliver its services. A subprocessor is any third party that processes personal data on our behalf and under our instruction.
This page lists all subprocessors currently engaged by Coreframes Lab, the purpose for which they are engaged, their entity country, and where your data is hosted. We review our subprocessors regularly and update this list when changes occur.
| Subprocessor | Purpose | Entity country | Data location |
|---|---|---|---|
| Supabase, Inc.supabase.com | Database, file storage, and authenticationAll customer data at rest — employer records, maid biodata, documents, conversation logs, and user accounts are stored in Supabase's managed Postgres and object storage. | United States | AWS ap-southeast-1 (Singapore) |
| Amazon Web Services, Inc.aws.amazon.com | Cloud infrastructureUnderlying infrastructure provider for Supabase. All data is hosted in the ap-southeast-1 (Singapore) region. | United States | Singapore (ap-southeast-1) |
| Railway Corp.railway.app | Backend application hostingHosts the Coreframes Lab backend API and webhook processing services. Deployed in the Singapore region. | United States | Singapore |
| Vercel, Inc.vercel.com | Frontend hosting and CDNServes the Coreframes Lab web application. Static assets are distributed via Vercel's global CDN. No personal data is stored at edge nodes. | United States | Global CDN (no personal data stored) |
| Meta Platforms, Inc.www.whatsapp.com/business/api | WhatsApp messaging deliveryProcesses inbound and outbound WhatsApp messages through the WhatsApp Business Platform (Cloud API). Message content is transmitted through Meta's infrastructure for delivery. | United States | Meta global infrastructure |
| Google Cloud (Vertex AI)cloud.google.com/vertex-ai | AI assistant replies, voice-note transcription, and knowledge searchWhere an agency enables the AI assistant, the customer's message text (and voice notes, where sent) is processed to generate a reply, produce a transcript, or search that agency's own knowledge base. Requests are pinned to the asia-southeast1 (Singapore) regional endpoint, so this processing occurs in Singapore. Content is not used to train models. | United States | Singapore (asia-southeast1) |
| Google LLC (Calendar API)developers.google.com/calendar | Appointment and viewing bookingsWhere an agency connects a Google Calendar, appointment details — such as the customer name, contact number and booking time — are written to that calendar. Processed on Google's global infrastructure. | United States | Google global infrastructure |
| Resend, Inc.resend.com | Transactional email deliveryDelivers system email such as team invitations, access requests and account notifications. Recipient email addresses and message contents pass through Resend for delivery. | United States | United States |
| Stripe Payments Singapore Pte. Ltd.stripe.com | Subscription billing and card paymentsTakes payment for subscriptions. Receives the billing contact’s name and email address, and the card details entered on Stripe’s own hosted checkout page — card numbers are never sent to, seen by, or stored by Coreframes Lab. No client or enquiry data is shared with Stripe. | United States | Global — primarily United States |
Coreframes Lab reserves the right to add, remove, or replace subprocessors at any time, subject to the notice period described above for customers under a DPA. We will always maintain the current authorised subprocessor list on this page.
If you would like to be notified automatically when this list changes, please contact admin@coreframeslab.com to be added to our subprocessor change notification list.
For questions about our subprocessors or data processing practices, contact our Data Protection Officer:
Related: Data Processing Agreement · PDPA Policy · Privacy Policy · Security
