Overview
Market Fortress engages a limited set of sub-processors to deliver the Service. Each sub-processor is reviewed against our security, privacy, and contractual standards before any customer data flows to it, and each is bound by a written data processing agreement that survives termination.
We make material changes to this list with at least 30 days advance notice. Customers may subscribe to change announcements via the contact note in the footer of this page.
Sub-processor Registry
| Sub-processor | Purpose | Data Categories Processed | Hosting Region | Last DPA Review |
|---|---|---|---|---|
| Supabase | Primary database, authentication, file storage, realtime channels. | Customer data (including MNPI), account metadata, session tokens, audit logs. | United States (US-East). EU region available on request. | 2026-05-26 |
| Vercel | Application hosting, edge functions, static asset delivery. | Request logs, IP addresses, server-rendered HTML payloads. | United States, European Union, global edge network. | 2026-05-26 |
| Stripe | Subscription billing and payment processing. | Payment instruments, billing email, invoice records. | United States, European Union, global. | 2026-05-26 |
| Resend | Transactional email delivery (notifications, password resets, exports). | Recipient email address, message subject, message body. | United States. | 2026-05-26 |
| Anthropic | AI inference (Claude API) for the ACE assistant, the website chat, and some drafting, review and extraction features. | Prompts, including document and record text, and AI responses. This can include MNPI. | Stored data: United States. Model processing: may run outside the United States under Anthropic's default setting. | 2026-05-26 |
| Google Cloud / Vertex AI | AI inference in Market Fortress's own Google Cloud project for draft filings, board materials, vault questions and document extraction. | Prompts, including document and record text, and AI responses. This can include MNPI. | United States. | 2026-05-26 |
| Google (Gemini API) | AI analysis of published filings and press releases, and of filings uploaded for automatic extraction. | Filing and document text, and AI responses. | Any country where Google or its agents maintain facilities, per Google's Gemini API terms. | Not recorded |
| Sentry | Application error monitoring and performance tracing. | Error stack traces, redacted request context, user identifiers. | United States (US-East). | 2026-05-26 |
| Plaid | Bank account linking for financial verification. | Account holder name, account balances, institution metadata. | United States. | 2026-05-26 |
| DocuSign | Electronic signature collection on filings and engagement letters. | Signer email, signer name, executed PDF artifacts. | United States, European Union. | 2026-05-26 |
| QuickBooks | OAuth-based accounting data pull (Intuit). | Trial balance, chart of accounts, journal entries. | United States. | 2026-05-26 |
| Xero | OAuth-based accounting data pull. | Trial balance, chart of accounts, journal entries. | United States, Australia, European Union, United Kingdom. | 2026-05-26 |
| Carta | OAuth-based cap table synchronization. | Cap table entries, equity holder identifiers, share counts. | United States. | 2026-05-26 |
| Slack | OAuth-based notification delivery to customer workspaces. | Channel posts, channel identifiers, OAuth tokens. | United States. | 2026-05-26 |
| Zoom | OAuth-based meeting metadata and recording transcript ingestion. | Meeting metadata, participant lists, transcripts. | United States, European Union. | 2026-05-26 |
| Microsoft 365 | OAuth-based calendar metadata for deadline syncing. | Calendar entries, attendee lists, event titles. | Global (per Microsoft tenant region). | 2026-05-26 |
| Inngest | Background job queue and scheduler for long-running workflows. | Job payload metadata, retry state, execution timestamps. | United States. | 2026-05-26 |
Change Notifications
Material updates to this registry (adding a sub-processor, changing the data categories sent to an existing sub-processor, or changing hosting regions) are announced with at least 30 days advance notice. To object to a new sub-processor, contact us within the notice window.
Contact
Questions about a specific sub-processor, or to subscribe to change notifications, email ace@marketfortress.app.