legal
Sub-processors
Everyone who touches your data, and what for. Short because keeping it short is treated as a design constraint.
Written from the system, not from a template. Every statement here describes what the software actually does — the region, the sub-processors, what is collected, what is retained, what leaves the EEA. It is a description of a system rather than legal advice, and it is published rather than sent after a call. If your counsel needs redlines, or your own paper, that is a conversation and not a problem.
This page is annex III to the data processing agreement. It is the complete list of parties Touch Grass AB engages to process customer data. There is no second list and no category of "affiliates" doing the same work under another name.
▸Contents — 4 clauses
1The list#
| Sub-processor | What it does | What it can reach | Where |
|---|---|---|---|
| Supabase | Managed Postgres, authentication, file storage and server-side functions. The system of record. | All customer content and account data. | EU — Stockholm |
| Vercel | Serves the website and the application bundle, and applies the edge configuration. | No customer content. Request metadata, including IP addresses, in the ordinary course of serving a page. | Frankfurt (eu-central-1), pinned in the deployment configuration. |
| OpenRouter | Routes requests from the four AI features to a model provider. | The text sent by whichever feature was invoked. | Outside the EEA |
| Model providers, via OpenRouter | Perform the generation, the guideline reading, the compliance review or the claim analysis. | The same text. The model used is recorded against each generation and each release. | Varies by model. Outside the EEA. |
| Web search, via OpenRouter | Used by claim research only, to find the published source a claim is checked against. | The claim being checked and the sources you nominate. | Outside the EEA |
| Supabase, using the platform's own delivery. No separate email provider is configured. | Delivers sign-in links and account invitations. | Email addresses, and the contents of those messages. | To be confirmed with the entry |
Payment processing is absent from this list because there is no billing system. When there is one, its provider will be added under clause 3 before it starts processing.
2What leaves the EEA, and what never does#
3Changes to this list#
An addition or replacement is announced by email to account owners at least 30 days before it begins processing. You may object on reasonable data protection grounds within that window, and if we cannot accommodate the objection you may terminate the affected part of the service without penalty. The version number at the top of this page changes with the list.
4The ones deliberately not on it#
There is no analytics provider, no error reporting service, no session recorder, no customer messaging widget, no advertising network and no content delivery network for user-uploaded assets. Two features that would have been trivial with an external service were written in-house specifically to avoid adding a name here. A short sub-processor list is a smaller attack surface, a shorter vendor assessment for you, and fewer places your customers' data can be somewhere you did not expect.
Sub-processors, version 0.3, effective 29 July 2026. Every agreement, and who you are contracting with, on the legal index.