Service providers and subprocessors
Inventory updated September 27, 2026. RevenuePilot uses the following services for Takt. The providers receiving a customer’s personal data depend on the deployed environment and enabled features; customer-specific processing and transfer terms belong in the agreement.
Ready for lawyer review. Pending Shaun. A SaaS lawyer should review this draft once before a pilot signs. It is not legal advice and it is not a signed agreement.
Vercel — application hosting
Hosts the web application and request execution. Processes application requests, network metadata and service logs. A hosting region does not by itself guarantee all provider processing stays in that region.
DigitalOcean — database and object infrastructure
Provides infrastructure for the PostgreSQL database and Spaces-compatible object storage and backups when configured. May store customer operational records, attachments and protected backups. Request the deployment-specific region and retention schedule.
OpenAI — optional AI processing
Processes purpose-limited input and produces AI output for enabled, user-requested features. API data is not used for model training by default. Standard abuse-monitoring retention can be up to 30 days with legal and safety exceptions; Takt’s request not to save responses does not establish Zero Data Retention. See the linked provider data controls for detail.
Resend — transactional email
Delivers configured verification, invitation, recovery and support-notification emails. Processes recipients, message contents needed for delivery and delivery metadata. Configuring an email provider does not prove delivery to an inbox.
Sentry — optional server error monitoring
When enabled for a deployment, Sentry receives limited server failure diagnostics: request and event references, timestamps, release version, environment, a broad operation category, response status, duration and a fixed error description. Takt’s adapter does not send prompts, raw exception messages or stacks, request or response bodies, URLs, cookies, user credentials or customer record contents. This entry does not confirm activation. Contact support for the configured processing region, retention and contractual safeguards applicable to your deployment.
Grok authentication broker — optional sign-in
The auth.grok.me broker is used only for deployments with that sign-in integration enabled. It processes the sign-in exchange and identity claims. This inventory does not mean every production customer uses that broker.
Google Fonts — public font delivery
Browsers request the site’s font files from Google. Google receives standard request information such as network address and browser headers. This is a website resource provider; plant record payloads are not sent as font requests.
Changes and customer questions
Contact support for the provider set, processing locations and contractual safeguards applicable to your workspace, or to raise a proposed-subprocessor objection. Customer-specific notification arrangements and the DPA govern provider changes.