Spensa - Subprocessors
Effective date: 11.06.2026
This page lists subprocessors and provider categories used to operate Spensa. The exact data processed depends on the customer's use of the service.
Infrastructure and hosting
Vercel: application hosting, deployment, serverless execution, edge delivery, and operational logs. Processing may occur in the EU/EEA and third countries depending on routing and service configuration.
PlanetScale PostgreSQL: production relational database for application data. Production database processing is configured in EU regions.
Upstash Redis: cache, queue, rate limiting, and short-lived operational state. Production Redis processing is configured in EU regions.
Google Cloud Storage: storage and delivery of uploaded files such as invoices, delivery notes, POS files, menu setup files, order template files, inbound email attachments, and recipe images. Processing occurs in the configured Google Cloud region and may involve Google support and security operations.
Email, billing, and security
Postmark / SMTP email provider: transactional email delivery, inbound email routing, order replies, verification emails, password resets, and delivery metadata.
Stripe: subscription management, billing portal, payment processing, invoices, tax-relevant billing records, and payment status webhooks.
Cloudflare Turnstile: abuse prevention and bot protection on signup, login, password reset, and related protected flows.
Monitoring and analytics
Sentry: error monitoring, performance monitoring, crash diagnostics, technical logs, and, after analytics consent, Session Replay with broad page unmasking and richer browser user context.
Mixpanel EU endpoint: optional product analytics for feature usage and product improvement after analytics consent. Mixpanel is configured with the EU API endpoint.
Document processing and AI providers
LandingAI: document extraction and OCR processing for uploaded or inbound files.
OpenAI: AI-assisted extraction, classification, matching, analytics, and assistant features. Inputs depend on the feature used and may include customer-provided operational data needed for the requested function.
Changes to subprocessors
Spensa may update this list when providers are added, replaced, or removed. Customers may object to a new subprocessor where the Data Processing Agreement at /data-processing-agreement or contract gives them that right.