Subprocessor List
Correction, 8 October 2026. We added Google (Google Workspace), which hosts our own mailbox and the form behind the site feedback widget, to this list, and we widened Resend's entry to the messages sent through our contact form and the email series for the guides. Both were existing recipients that the list had left out.
Correction, 29 September 2026. We corrected the Upstash entry (API keys are stored as issued, not hashed), removed a sentence about email content that was not accurate, removed a demo-scheduling service we no longer use, corrected the number of the Privacy Policy section on changes, and added saved watchlists, webhooks and unsubscribe records to what it says the database holds.
This page lists the service providers ("subprocessors") that may process personal data on behalf of Holistic Quality LLC in connection with the ALETHEIA chemical safety reference API and related websites. It supplements the ALETHEIA Privacy Policy and mirrors the canonical subprocessor list maintained in the HQ Data Policy v2.0. The machine-readable source of record, including per-processor transfer mechanism status, is at /api/compliance.
This list reflects the current operational state of the Service and is maintained as our infrastructure and tooling evolve.
1. Categories
Subprocessors are grouped by function. Each subprocessor is named, with its role, the regions in which it primarily processes data, and a link to its own privacy or data-processing information.
1.1 Hosting and compute
| Subprocessor | Role | Processing regions | References |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute for API endpoints, website hosting | United States (primary), edge regions globally |
Privacy Policy DPA |
1.2 DNS
| Subprocessor | Role | Processing regions | References |
|---|---|---|---|
| Cloudflare, Inc. | DNS only. No website traffic, logs or personal data pass through Cloudflare. | — | — |
1.3 Key storage and rate limiting
| Subprocessor | Role | Processing regions | References |
|---|---|---|---|
| Upstash, Inc. | Serverless Redis — API key records, email addresses, usage counters, rate-limit counters, trial flags, enterprise inquiry data, saved watchlists, webhook registrations and their delivery logs, unsubscribe records | European Union — AWS eu-west-1 (Ireland) |
Privacy Policy DPA Subprocessors |
1.4 Operational tooling
| Subprocessor | Role | Processing regions | References |
|---|---|---|---|
| Stripe, Inc. | Payment and subscription processing for direct-issued accounts. Card data never touches ALETHEIA servers (PCI SAQ-A). Holistic Quality stores the Stripe customer, subscription and checkout-session references, the subscription and payment status (including cancellation and payment-failure details), and the customer email. | United States (PCI-DSS Level 1) |
Privacy Policy DPA Subprocessors |
| Resend (Resend Inc.) | Transactional email delivery for direct-issued accounts (API key issuance, trial reminders, security advisories, rights-request verification), for the messages you send through our contact form (our notification to us and our reply to you) and for the email series for the guides you request. | United States |
Privacy Policy DPA Subprocessors |
| Google (Google Workspace) | Email and forms hosting. Hosts Holistic Quality's own mailbox and the form behind the site feedback widget: messages you send through our contact form, replies to our emails, and reports you send through the feedback widget reach it. Google Forms is one of the Google Workspace services that Google's Workspace terms list. Not a sub-processor of Customer Personal Data under our DPA. | Google may process data in any country where Google or its subprocessors maintain facilities, subject to its data location commitments (Google Cloud Data Processing Addendum, section 10.1). |
DPA Subprocessors |
2. Independent data controllers (not subprocessors)
The following entity is not a subprocessor of Holistic Quality. It acts as an independent data controller for its own users' account and billing information, governed by its own terms and privacy policy. It is listed here for transparency because many ALETHEIA users will interact with it.
| Entity | Relationship | References | |
|---|---|---|---|
| R Software Inc. (RapidAPI) | Independent data controller for marketplace users' account and billing data. Holistic Quality receives only the limited information described in Privacy Policy §2.1 from RapidAPI. |
Privacy Policy Terms |
|
3. How we vet subprocessors
Before engaging a subprocessor that will process personal data on our behalf, we verify:
- the provider publishes a privacy policy and, where applicable, a Data Processing Addendum
- the provider has a reasonable security posture (encryption in transit, access controls, recent compliance certifications where relevant)
- the provider's data-processing geography is compatible with our commitments to users
- the provider's role aligns with the purposes described in our Privacy Policy
4. Updates to this list
We may add, remove, or replace subprocessors from time to time. Material changes will be reflected on this page. Where we add a subprocessor that will receive personal data covered by a user's right to object, we will announce the change through the channels described in Privacy Policy §12 before the change takes effect, unless the change is required for security, fraud prevention, or legal compliance and cannot be delayed.
The "Last Updated" date at the top of this page indicates the most recent revision.
5. Contact
Questions about this Subprocessor List, or to receive advance notice of additions:
Holistic Quality LLC
Lebanon, Ohio
privacy@holisticquality.io