Subprocessors
Last updated: October 26, 2026
These are the companies Ancor uses that process the data an agency puts into Ancor. Ancor is the processor for that data and the agency is the controller, under our data processing agreement.
The list
| Provider | What it does | Where it runs | Transfer safeguard |
|---|---|---|---|
| Google Cloud (Cloud Run, Cloud Storage, Secret Manager, Cloud Logging) | Runs the application, stores uploaded files and daily backups, holds secrets, keeps server logs | Mumbai, India (asia-south1). Server logs are kept in Google Cloud Logging's global storage. | Google Cloud Data Processing Addendum, which includes the EU SCCs |
| Google Vertex AI | Runs the AI features (planning, reports, skill extraction) on Gemini models. Google does not train its models on this data. | Mumbai, India (asia-south1) | Google Cloud Data Processing Addendum, which includes the EU SCCs |
| Supabase | Hosts the PostgreSQL database | Mumbai, India (AWS ap-south-1) | Supabase data processing addendum, which includes the EU SCCs |
| Upstash | Redis cache: rate-limit counters, and short-lived copies (30 minutes at most) of sign-in session data and some computed summaries such as team wellbeing and budget burn | Tokyo, Japan (Google Cloud) | Upstash data processing addendum, which includes the EU SCCs |
| Resend | Sends the service's email: invites, notifications, invoices sent by email | Sends from Tokyo, Japan (AWS ap-northeast-1). Resend is a US company. | Resend data processing addendum, which includes the EU SCCs |
| Sentry | Error monitoring. An error report can include the user's ID, email address, workspace ID and request details; passwords, tokens and cookies are removed first. | United States | Sentry data processing addendum, which includes the EU SCCs |
| PostHog | In-app product analytics, including session recordings with typed inputs masked. Loads only after the user agrees to analytics cookies. | European Union (PostHog EU Cloud) | PostHog data processing addendum; the data stays in the EU |
| Firebase Hosting (Google) | Serves the website and app files and forwards app requests to the application | Global edge network | Firebase data processing terms, which include the EU SCCs |
| Cloudflare | DNS and network in front of getancor.com. All traffic passes through it, encrypted. | Global edge network | Cloudflare data processing addendum, which includes the EU SCCs |
| Razorpay | Takes payment for your Ancor subscription. Ancor does not store full card details. | India | Same country as Ancor; Razorpay's own terms |
Data from agencies in the UK and the EEA reaches Ancor in India under the EU Standard Contractual Clauses and the UK Addendum in our data processing agreement. Copies of a provider's terms are available on request.
Changes: 30 days' notice
Before a new subprocessor starts processing your agency's data, we give at least 30 days' notice. We update this page and email every workspace owner and everyone on the subprocessor list. If you object on reasonable data protection grounds, tell us within those 30 days. If we cannot resolve it, you can leave before the change and we refund any prepaid fees for the unused period.
To join the subprocessor list, email hello@getancor.com with the subject "Add me to the subprocessor list".
Not on this list, and why
- Tools you connect yourself. If your agency connects Slack, Microsoft Teams or Zoho, data goes to that tool because you asked for it. Those are your providers, under your own agreement with them.
- Our own website tools. Google Analytics, Microsoft Clarity, the Meta Pixel, the LinkedIn Insight Tag and Calendly run on Ancor's marketing website, only with consent where the privacy policy says so. They do not receive the data inside your workspace.
Questions
See also how Ancor looks after your data and the trust centre.