Legal
Subprocessors
Tribe AccredAI engages the following subprocessors to deliver the platform. We require each subprocessor to be bound by data-protection terms no less protective than our DPA.
Last Updated: May 2026
The register below is organized by data category so institutional procurement teams can quickly identify the role each vendor plays in delivering the platform, the region in which they operate, and whether they may process education records.
| Subprocessor | Data Category | Purpose | Region | Education records? | DPA |
|---|---|---|---|---|---|
| Supabase (managed Postgres + Storage) | Database & File Storage Provider | Primary database and evidence file storage | US | Yes | DPA |
| Cloudflare | Edge Hosting & Network Provider | Edge hosting, TLS termination, DDoS protection | Global edge | Yes (in-transit only) | DPA |
| Lovable AI Gateway (OpenAI, Google models) | AI Processing Provider | AI-assisted analysis of evidence (opt-in for identifiable records) | US / EU (model-dependent) | Conditional | DPA |
| Resend | Email Delivery Provider | Transactional email (invites, notifications) | US | No (metadata only) | DPA |
| Paddle | Billing Provider (Merchant of Record) | Billing, tax, invoicing | Global | No | DPA |
Tribe Consulting, LLC reviews new subprocessors before onboarding and will notify Customers of material changes in advance. To receive subprocessor change notifications, contact legal@tribeaccredai.com.