Data processors — kept current

Every company that touches your data.

To run Olto Discovery we rely on a small set of third-party providers — our subprocessors. Each one is listed below with what it does, the categories of data it handles, and where it operates. This is the same set named in our Privacy Policy. We keep the list here honest and current.

Last updated July 2026

Current subprocessors

Who processes what, and where.

A subprocessor is a third party that processes personal or research data on our behalf to deliver the Service. We require each to maintain appropriate technical and organizational safeguards. Some report SOC 2 or SOC 2-aligned programs — that is a property of the provider, not a certification of Olto Discovery.

  • Supabase
    Supabase, Inc.
    Primary database, authentication, and file storage
    Account records, saved research content (protocols, notebooks, findings, projects), hashed credentials and session tokens, and any files you upload.
    United States
  • Vercel
    Vercel, Inc.
    Application hosting and content delivery (CDN)
    HTTP request metadata (IP address, user agent, requested paths) and served application assets; performance telemetry via Vercel Analytics / Speed Insights.
    United States
  • Anthropic
    Anthropic PBC
    AI inference for AI-assisted features (protocol generation, refinement, simulation, assistant chat)
    The prompts, protocol text, assistant messages, and any files or content you submit to an AI feature. Not end-to-end encrypted: this content is transmitted to Anthropic to produce the response.
    United States
  • Stripe
    Stripe, Inc.
    Payments and subscription billing
    Billing contact details, payment card or token data handled directly by Stripe, and subscription and transaction records.
    United States
  • Resend
    Resend
    Transactional email delivery
    Recipient email address and the contents of transactional messages (for example, password resets, workspace invitations, and billing notices).
    United States
  • PostHog
    PostHog, Inc.
    Product analytics (used only after you consent)
    Product-usage events, feature interactions, and associated device/session identifiers. Collected only after you opt in via the on-site cookie banner.
    United States or European Union, depending on our configuration
  • Google Analytics
    Google LLC
    Site analytics (used only after you consent)
    Site-usage events with IP anonymization enabled. Collected only after you opt in via the on-site cookie banner.
    United States
  • hCaptcha
    Intuition Machines, Inc.
    Bot and abuse protection on sign-in and sign-up
    Challenge-interaction signals and related request metadata (including IP address and user agent) used to distinguish humans from automated abuse.
    United States

“Region” describes where a provider primarily operates for our account, to the best of our knowledge. Providers may route or replicate data across their own global infrastructure under their terms; we do not assert a data-residency guarantee for any provider except where a signed agreement expressly provides one.

Change notice

We update this page when our subprocessors change.

When we add, remove, or replace a subprocessor, we revise this page and move its “last updated” date forward. This page is the authoritative list of the providers currently in use. Enterprise customers with a written agreement that includes advance-notice terms are notified in line with that agreement.

Questions about a specific provider, its data handling, or a data processing agreement? Email privacy@oltodiscovery.com.