SourceFlag

SourceFlag subprocessors

Subprocessors and Service Providers

SourceFlag uses managed providers to operate the website, dashboard, billing, storage, AI-assisted features, business email, and optional walkthrough video embeds.

Effective October 17, 2026 · Version sourceflag.subprocessors.2026-10-17.v2

This disclosure describes customer-facing provider purposes and data categories. It is not proof of an executed provider DPA, a fixed processing region, a special retention control, or provider deletion completion.

Human Review may be used only with customer-authorized public or unclassified solicitation material. AI features may be used with that material and with the company and proposal content the customer has authorized for AI use. When a customer uses an AI feature in a processing project, SourceFlag sends the content needed for that request to its disclosed AI provider under SourceFlag-controlled credentials. Depending on the feature, that content can include solicitation text and excerpts, the customer's questions, instructions, and recent conversation messages, working proposal text and win themes, and approved company facts and experience from the company library that the customer has authorized for AI use. Marking a library item ready for reuse does not by itself authorize AI use. Ordinary business-confidential proposal material that the customer has not authorized for AI use belongs only in a private_storage_only project, where it may be stored and manually organized. AI features, Human Review, and background processing are locked off for that project. Provider handling follows the applicable endpoint, account configuration, provider terms, and evidenced controls. Authorized SourceFlag Team members and disclosed service providers may access information only when needed to operate, secure, support, or perform an authorized Human Review. Ordinary business-confidential proposal material that the customer has not authorized for AI use belongs only in a private_storage_only project, where it may be stored and manually organized. AI features, Human Review, and background processing are locked off for that project.

OpenAI API

Purpose

SourceFlag-controlled OpenAI API processing for customer-authorized AI features and preparation checks.

Data categories

Authorized public or unclassified solicitation content and source excerpts; company and proposal content the customer has authorized for AI use (approved company facts and experience, win themes, working proposal text, and project records); names or email addresses of workspace members where that content carries them; prompts, questions, and recent conversation messages; spoken questions, sent as audio for transcription when the customer uses Voice input (SourceFlag does not store the recording); answer text, converted to speech when the customer uses read-aloud; generated outputs; and limited request metadata, including a pseudonymous identifier for the workspace user. Ordinary business-confidential proposal material that the customer has not authorized for AI use belongs only in a private_storage_only project, where it may be stored and manually organized. AI features, Human Review, and background processing are locked off for that project.

Notes

Provider handling follows the applicable endpoint, account configuration, provider terms, and evidenced controls. SourceFlag does not claim universal zero retention or immediate provider deletion.

Supabase

Purpose

Authentication, database, private storage, and workspace records.

Data categories

Account data, auth/session data, workspace data, official-source review records, generated artifacts, and Ask/chat history.

Notes

Used for hosted dashboard identity, private file storage, and workspace persistence.

Stripe

Purpose

Checkout, billing, subscriptions, customer portal, invoices, payment processing, AI usage packs, and limited payment metadata.

Data categories

Billing metadata, customer records, subscription status, payment status, and limited payment method details.

Notes

SourceFlag does not intentionally store full payment card numbers.

Vercel

Purpose

Website and dashboard hosting.

Data categories

Website/dashboard delivery data, request metadata, and technical logs.

Notes

Used to host and deliver the public website and hosted dashboard.

Render

Purpose

Background processing. Render stores our processing workspace and our encrypted backup copies of files stored in the Service, and keeps daily snapshots of that storage for seven days.

Data categories

Job processing data, file-processing tasks, the processing workspace, encrypted backup copies of files stored in the Service, workflow metadata, and technical logs.

Notes

Used for background processing infrastructure.

Google Workspace

Purpose

Business email and administration.

Data categories

Email communications and administrative records.

Notes

Used for SourceFlag business communications.

Resend

Purpose

Transactional, billing, product, and opt-in SourceFlag Opportunity Brief email delivery.

Data categories

Email addresses, contact and topic subscription state, delivery metadata, message content, unsubscribe state, and bounce, complaint, or suppression event metadata.

Notes

Used to deliver operational SourceFlag emails and the common staff-curated Opportunity Brief digest. SourceFlag keeps complaint, bounce, and provider suppression states non-reactivatable through the public form.

YouTube privacy-enhanced embeds

Purpose

Optional marketing walkthrough video embeds.

Data categories

Video interaction data processed by YouTube/Google when users interact with embedded videos.

Notes

Optional only. When a privacy-enhanced walkthrough embed is configured, YouTube/Google may process interaction data. Current hosted use requires exact environment evidence.

A Data Processing Addendum applies only when it is expressly incorporated into a signed customer order or agreement.

SourceFlag may update subprocessors as the service evolves. SourceFlag will publish the current list here and, when an applicable signed DPA, order form, or law requires it, provide advance notice of a material new subprocessor through the agreed notice channel. An authorized customer may raise a documented data-protection objection at privacy@sourceflagworkspace.com. The governing DPA or order form controls the review, mitigation, and any termination right; no universal notice period or objection remedy is promised by this page.