Skip to main content
WHISKERMATCH
My hearts
Subprocessors

Who touches visitor data, and why.

The list is intentionally bounded: hosting, configured database and private storage, optional transactional email and profile drafting, plus conditional public listing discovery. No CRM, analytics vendor, or advertising platform.

Read security overviewPrivacy policy
Effective October 4, 2026
Subprocessor list

Every current external service boundary, including optional ones.

Pilot requests, animal records, and uploaded source material are stored in the configured database and private file storage, not forwarded to a third-party CRM or used for advertising. Optional services and public-data sources are listed even when inactive in a particular environment. This page will be updated before any new service is activated.

  • Vercel
    Role
    Hosting & edge network
    What it does
    Web application hosting and edge delivery for the marketing site and the shelter application. May retain standard short-lived server access logs per Vercel's own policies.
    Location
    Global edge network
  • Supabase
    Role
    Database & private file storage
    What it does
    Hosts the Postgres database (organizations, animal records, applicants, holds, foster notes, pilot requests) and private object storage for uploaded source material (intake photos, medical documents). Storage is not publicly accessible, every download uses a short-lived signed link.
    Location
    Region selected at deployment
  • Resend
    Role
    Transactional email (optional)
    What it does
    Sends pilot-request notifications, password-reset links, and team-invitation emails when configured. If not configured, these events still persist in the database and remain visible in the app, nothing is silently dropped.
    Location
    United States
  • Anthropic
    Role
    Public-profile drafting (optional)
    What it does
    Receives the animal name, species, and public-safe source lines an authorized reviewer entered for one organization-owned public-profile draft when an Anthropic key is configured. Related applicants, uploads, documents, and external-provider records are not automatically loaded. The form warns against sensitive text and blocks obvious email addresses and phone numbers, but the reviewer remains responsible for what they enter. A deterministic template is used when Anthropic is not configured.
    Location
    Per Anthropic service terms and deployment
  • OpenFreeMap
    Role
    Map tiles (conditional)
    What it does
    Serves the base map on the discovery and Lost & Found maps. Your browser requests map tiles directly, so the service sees ordinary request data such as IP address. Report and listing positions are drawn by your browser and are not sent to it. A different provider can be configured.
    Location
    Provider infrastructure
  • Zippopotam.us
    Role
    Postal-code lookup (conditional)
    What it does
    Receives only a US ZIP code or the first three characters of a Canadian postal code from our server, to place a Lost & Found report, a sighting, a search or a community-cat report on a map or in an area. No report text, photo, or contact detail is sent.
    Location
    Provider infrastructure
  • Cloudflare Turnstile
    Role
    Human check on Lost & Found forms (optional)
    What it does
    Used only if keys are configured. It receives ordinary browser signals and the visitor's IP address to tell people from bots. Without keys, forms use a hidden field, a timing check, and rate limits.
    Location
    Provider infrastructure
  • Stripe
    Role
    Organization card billing and donations (optional)
    What it does
    Used only if configured. Processes the $20/month organization subscription on Stripe-hosted pages, and donations to an organization on that organization's own Stripe account (Stripe Connect), so card details never reach WhiskerMatch. WhiskerMatch receives payment status, amounts and invoice links through signed webhooks. Nobody is charged for using the public site.
    Location
    United States / provider infrastructure
  • RescueGroups.org
    Role
    Public adoption-listing source (conditional)
    What it does
    Receives server-side species, radius, and postal-code or approximate-coordinate searches only in RescueGroups discovery mode. It supplies temporary public animal and organization records, source media, and required tracker images; WhiskerMatch does not send its shelter-workspace records to this provider.
    Location
    United States / provider infrastructure
What is not on this list

There is no CRM, no marketing automation platform, no third-party analytics or advertising service, and no data broker in this stack. A direct email to support@whiskermatch.com goes to a standard inbox, governed by that provider's own policies, not through any of the above. When new services are added, this page will be updated before they go live.

Subprocessors

Questions about our infrastructure?

If you need specifics about where data is stored or how it is protected, get in touch.

Email Chris directlySecurity overview