Trust & security
Subprocessors
We use the following subprocessors to deliver AcuityRFP. Here is what each one does and which data it handles.
Last updated: November 7, 2026
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage, realtime updates | All customer data (encrypted at rest with AES-256) |
| Vercel | Web application hosting and edge network | Data in transit and runtime execution logs |
| Inngest | Asynchronous background job orchestration | Job inputs and results, which can include document and question text |
| Google Cloud (Gemini API) | AI language processing, drafting and translation | Questions, selected document excerpts, approved answers and text your team types when regenerating answers (paid commercial tier; excluded from model training) |
| Voyage AI | Vector embeddings and search re-ranking | Document excerpts and questions (processed with zero data retention) |
| Resend | Transactional and notification emails | Recipient email address and notification content |
| Cloudflare (Turnstile) | Bot check on the sign-up page | IP address and browser signals of people signing up (no customer content) |
| Sentry | Error monitoring | Error reports: error type and message, stack trace, page address, browser and device type, and organization ID. Email addresses, tokens and quoted text are removed first, and document contents aren't sent on purpose, though an error message can still contain a short piece of text. Stored in the United States and deleted within 90 days |
| Stripe | Payment processing and tax/VAT calculation, as the seller of record | Billing contact, address, tax ID and payment method (held directly by Stripe; we never view or store card numbers) |
Optional third-party integrations
Slack, Microsoft Teams, Google Drive, Microsoft SharePoint, and OneDrive receive or share data only if an Administrator or Owner explicitly connects them. From Google Drive, SharePoint, and OneDrive, AcuityRFP accesses only the specific files you select. AcuityRFP's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to this list
For how we protect your data, see our security page.