Subprocessors
Last updated: 24 September 2026
To provide Kalma, Tekio Consulting and Engineering Ltd uses providers that act as processors (subprocessors) on our behalf, under the corresponding data processing agreements. Below we list who they are, what we use them for, where they process data and which personal data they may process.
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Supabase | Database | EU (Frankfurt, Germany) | Account and project data |
| Vercel | Application hosting and execution | EU (Frankfurt) · global delivery network | Technical and log data, and data passing through the application |
| Resend | Email delivery | USA | Name, email and email content |
| PostHog | Cookieless product analytics and error tracking | EU | Usage events, account identifier, name and email |
| Upstash | Rate limiting (abuse protection) | EU | IP addresses (temporary counters) |
Independent third parties
Google (sign-in) and Autodesk (Construction Cloud integration) are not subprocessors: when you choose to use them, they process your data as independent controllers under their own policies.
International transfers
Where a subprocessor processes data outside the European Economic Area, the transfer relies on appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
Changes to the list
We will notify you by email of any new or replacement subprocessor at least fifteen (15) days in advance, in line with our DPA, giving you the opportunity to object on reasonable data protection grounds.