Last updated October 14, 2026

Sub-processors

To run Wisam we rely on a small number of third-party providers that process personal data on our behalf ("sub-processors"). This page lists each one, what it does, the data it handles, and where it is. It is referenced by our Privacy Policy and Data Processing Agreement.

The short version

Five providers, each for a specific operational job — none for advertising.

Primary data storage is in South Korea; some providers operate from the United States.

We will post changes here before a new sub-processor starts handling your data.

1. What a sub-processor is

A sub-processor is a company we engage to help operate the Service and that, in doing so, may process personal data we or our institution customers control. We put each under contractual data-protection obligations and share only the data they need for their role.

2. Current sub-processors

Supabase — database, authentication, and file storage hosting. Data: all account and credential data, uploaded files. Location: South Korea (Seoul).
Resend — delivery of transactional email (credential delivery, login and verification links, reminders). Data: recipient name, email address, and the email content. Location: United States.
Vercel — hosting and serving of the website and its edge functions. Data: IP addresses and request metadata in transit. Location: global edge network (US company).
Cloudflare — DNS, content delivery, and the anti-bot challenge on signup and login. Data: IP address and browser signals. Location: global network.
GlitchTip — error monitoring. Data: IP address and the technical context of an error, sent only when the site crashes in your browser. Location: United States.
Stripe — payment processing for institution plans. Data: the billing contact's name, email, billing address, tax ID and card details, entered directly with Stripe. Location: United States.

Fonts are self-hosted on our own site, so no font service (such as Google Fonts) is a sub-processor or sees your visit.

3. International transfers

Primary storage is in South Korea, which holds an EU adequacy decision and a corresponding UK determination. Providers operating from the United States do so under their own data-processing terms and Standard Contractual Clauses. See the Privacy Policy for detail.

4. Changes and notice

We may add or replace a sub-processor as the Service evolves. When we do, we'll update this page and change the date at the top. Institution customers with a Data Processing Agreement can ask to be notified of changes and may object to a new sub-processor as set out in that agreement.

5. Contact

Questions about our sub-processors: privacy@wisam.app.