Service providers and subprocessors
Last updated . Version 2026-09-11.
This list identifies the services involved in operating LaunchProof. A provider's role depends on the data and feature involved; not every recipient is a subprocessor for customer reports.
EXPONENTIAL EDUCATION S.R.L. operates LaunchProof. See the privacy notice for company details and controller processing, and the DPA for processing on behalf of a customer.
Infrastructure and authentication
- Convex, Inc. Hosted database, backend functions, scheduled cleanup, and application data storage. Processes account and workspace records, uploaded reports, review notes, token hashes, usage, audit, and commercial records. It is a processor for our controller data and a subprocessor for customer report data. US provider with infrastructure and support processing governed by its service arrangements. Data processing agreement.
- Vercel Inc. Website and application hosting, server-side request handling, and delivery. Can process request and connection information, session data, and report content passing through application routes. It is a processor or subprocessor for hosted customer data, with separate controller purposes described in its terms. US provider with international delivery and support infrastructure. Data processing addendum and privacy notice.
- WorkOS, Inc. AuthKit identity, email-code authentication, Google sign-in integration, and sessions. Processes email, name, user identifiers, and authentication/security information. It supports account administration; it is not used to store uploaded report evidence. US provider; its DPA addresses international transfers and standard contractual clauses. Data processing addendum, privacy policy, and provider subprocessor list.
Services used when you choose the corresponding feature
- Google. Used when you choose Google sign-in through WorkOS. Google supplies identity information for authentication and processes its own account and security data under its policies. Google sign-in is an independent identity service, not a destination for LaunchProof report uploads. Processing can involve the EEA, the United States, and other countries. Google privacy policy.
- Stripe. Checkout, subscription management, payment processing, and billing portal when payments are available. Receives billing contact and payment details, order/workspace references, and transaction information. Stripe acts as a processor for certain services and as an independent controller for purposes including fraud prevention and legal compliance. It is not a report-storage subprocessor. Stripe's contracting entities and processing locations depend on its regional service terms, with international processing including the EEA and United States. Privacy policy and data processing agreement.
If you email support, your message is also handled by the email services involved in delivering and receiving it. Keep report evidence in the authenticated workspace and do not email target credentials or production customer data.
Locations and transfer safeguards
Our company is based in Romania. A provider's company address is not a guarantee of data residency. The services above may use additional infrastructure and support providers outside the EEA. We do not offer EU-only processing or a customer-selectable region through these terms.
Where a transfer is restricted by the GDPR, an applicable adequacy decision or appropriate safeguards such as European Commission standard contractual clauses are required. The linked provider agreements explain their published arrangements. Ask contact@exponentialeducation.ro for information about safeguards relevant to your data.
Changes and questions
We update this list when a service provider changes. For customer data covered by an agreed DPA, additions or replacements that process that data follow the DPA's advance-notice and objection procedure. Contact contact@exponentialeducation.ro about providers or a proposed change.