Subprocessors

Last updated: 2026-05-14

Föreningsdomare engages the following technical subprocessors to operate the service. The list is published in accordance with GDPR art. 28.2 and ISO 27701 B.8.5.6. With each subprocessor there is a data processing agreement (DPA) binding them to GDPR level. For the subprocessors with jurisdiction US below, transfers take place under applicable safeguards (EU Standard Contractual Clauses and the EU–US Data Privacy Framework respectively, where relevant). No further transfers outside the EU/EEA take place.

SubprocessorPurposeData categoriesJurisdictionDPAVerified
SupabaseDatabase, authentication and file storage (club logos, receipts).
  • Account
  • Match information
  • Documentation
  • Messages
  • Audit log
EUDPA2026-05-14
VercelHosts the web app and runs the server-side functions.
  • IP address (request logs)
  • Request metadata
USDPA2026-05-14
ResendSends transactional e-mail (invitations, passwords, notifications).
  • E-mail address
  • Mail content
EUDPA2026-05-14
SentryReceives error reports (with personal identifiers scrubbed).
  • Stack traces
  • User agent
  • Anonymised user id
EUDPA2026-05-14
PostHogAnonymous web analytics (prepared, not enabled in alpha — updated before activation).
  • Anonymised events
  • Session metadata
EUDPA2026-05-14
UpstashDistributed rate-limit counter (Redis).
  • IP address (hashed)
  • E-mail address (hashed)
  • User ID (hashed)
  • Endpoint identifier
EUDPA2026-06-09
GitHubSource-code hosting and CI/CD. No production personal data is stored at GitHub.
  • Developer accounts only (internal staff)
USDPA2026-05-14

Changes to the list

Additions or replacements of a subprocessor are published here together with a fragment in the service's public changelog. Data-controller clubs can subscribe to the changelog feed or contact support@foreningsdomare.se to be notified in advance.