This is Frontier Solutions’ current list of sub-processors for Taktbygg. It belongs with the data processing agreement, Annex IV. The three direct sub-processors are also named in the signed agreement. Further sub-processors are listed here and can be updated without re-signing that annex each time a direct provider changes an internal sub-processor.
The list is based on information published by Supabase, Vercel and Resend, and on Taktbygg’s verified configuration. Where a provider does not publish an exhaustive statement of technical processing location or data categories, that limit is stated in the table. Absence of such public detail does not in itself mean that the processing is unlawful. The wording used is then not fully published by the provider.
Last compiled on 28 September 2026, from TIA-1.4 and the reconciliation of the providers’ lists on 27 September 2026. The Supabase sub-processor list used in that reconciliation is dated 1 June 2026. The date in the Last verified column is the date of the check that row relies on.
Direct sub-processors
Frontier contracts with these three. The customer gives general authorisation for them and for the further sub-processors they engage under each provider’s data processing agreement.
| Actor | Through | Function | Personal data | Geography | Source | Last verified |
|---|---|---|---|---|---|---|
| Supabase Pte. Ltd. | Frontier | PostgreSQL, authentication, object storage, and Edge Functions used for sending | Account and identity data, project content, uploaded files, IP address, technical logs, and data seen during support access | Primary storage: Stockholm (AWS eu-north-1). Edge Functions for sending: Frankfurt (eu-central-1). Contracting party in Singapore. Support or platform access may occur from a third country. | DPA · Sub-processors | Region lock 25 September 2026. List reconciled 27 September 2026. |
| Vercel Inc. | Frontier | Web application, serverless functions and CDN. Not the origin for project files. | Data in HTTP requests, sessions and technical logs | Functions: Stockholm (arn1). The CDN is global. Contracting party in the United States. CDN, edge and some platform data may be processed outside the EU/EEA. | DPA · Security and sub-processors | Function region 20 September 2026. DPF list 24 September 2026. |
| Plus Five Five, Inc. (Resend) | Frontier | Service e-mail and authentication e-mail. A generated schedule PDF may be attached. Uploaded project files are not sent. | E-mail address, name when it is part of the message, message content and delivery status | Sending: Ireland (eu-west-1) via mail.taktbygg.se. Storage of content and logs: United States. | DPA · Sub-processors | Sending region 20 September 2026. DPF list 24 September 2026. List reconciled 27 September 2026. |
Further sub-processors
Frontier has no contract of its own with these actors. They are engaged by Supabase, Vercel or Resend. Frontier relies on the direct provider’s data processing agreement, applicable standard contractual clauses or onward-transfer duties, and the sub-processor information the provider has published.
| Actor | Through | Function | Personal data | Geography | Source | Last verified |
|---|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Supabase | Infrastructure for the database, authentication and files | Customer data in primary storage | Stockholm (eu-north-1) for primary storage. Remote access from a third country may still occur. | Supabase | 25 September 2026 |
| Cloudflare, Inc. | Supabase | CDN/cache of fetched files. Origin in Stockholm. Retained until the origin is deleted, then for up to 60 seconds. | Cached file content and request data | Distributed network. A complete country list is not fully published by the provider. Contracting party in the United States. | Supabase | 27 September 2026 |
| Google (BigQuery) | Supabase | Platform logs, 7 days. Not the project database. | Operational log | Dataset region not fully published by the provider. Contracting party in the United States. | Supabase | 27 September 2026 |
| Fly.io | Supabase | Realtime (postgres_changes). Not primary storage. | Row content for projects, activities, notifications and hindrances | Cluster location not fully published by the provider. Contracting party in Chicago, United States. | Supabase | 27 September 2026 |
| Upstash | Supabase | Serverless data hosting according to Supabase’s list. Taktbygg does not call Upstash directly. | Categories of the customer’s personal data not fully published by the provider | Country list not fully published by the provider. Contracting party in San Jose, United States. | Supabase, list of 1 June 2026 | 27 September 2026 |
| Vercel Inc. | Supabase | Hosting according to Supabase’s list. This is not function execution in arn1 and not the direct Vercel chain above. | Categories of the customer’s personal data not fully published by the provider | Country list not fully published by the provider. Contracting party in Covina, United States. | Supabase, list of 1 June 2026 | 27 September 2026 |
| Amazon Web Services, Inc. | Vercel | Infrastructure for function execution | Data in execution and technical logs | Stockholm (arn1) | Vercel | 20 September 2026 |
| Amazon Web Services, Microsoft Azure and Google Cloud | Vercel | Backup of data that Vercel itself hosts, every two hours, for up to 30 days. The copy is not the Supabase database or the origin files. Function execution remains in arn1. | Data that Vercel hosts | Country list for the replicas not fully published by the provider | Vercel DPA and vercel.com/security | 25 September 2026 |
| Amazon Web Services, Inc. | Resend | Sending and storage of e-mail | E-mail content and delivery logs | Sending from Ireland. Storage in the United States. | Resend | 27 September 2026 |
| Cloudflare, Inc. | Resend | Firewall on Resend’s platform. Not the same function as the file cache through Supabase. | E-mail address and request metadata | Distributed network. A complete country list is not fully published by the provider. | Resend | 27 September 2026 |
| Datadog, Inc. | Resend | Monitoring | E-mail address and technical logs | United States, according to Resend | Resend | 27 September 2026 |
| PlanetScale, Inc. | Resend | Database hosting for Resend | E-mail address, message content and delivery data | United States, according to Resend | Resend | 27 September 2026 |
| Runpod, Inc. | Resend | A small sample of e-mail for trust and safety, on infrastructure Resend states that Resend operates. According to Resend, the content is not used to train or fine-tune models. | A small sample of e-mail content | United States, according to Resend | Resend | 27 September 2026 |
Other names on the published lists
The reconciliation on 27 September 2026 found more names than those with a specific function for Taktbygg customer data in the table above. They are included so the register is not silent about names the provider publishes. Where that reconciliation did not record a specific category of the customer’s personal data, the table says so. That is a documentation limit, not a conclusion that the processing is unlawful.
| Actor | Through | Function | Personal data | Geography | Source | Last verified |
|---|---|---|---|---|---|---|
| Braintrust, ConfigCat, Sentry, Hex, Latacora | Supabase | The function is stated on Supabase’s list. The function text is not repeated here beyond that published list. | Not fully published by the provider in the reconciliation Frontier has documented | Country not fully published by the provider | Supabase, list of 1 June 2026 | 27 September 2026 |
| Elastic, Estuary, Inngest, Liveblocks, Metabase, Plain, Retool, Snowflake, Svix, Tinybird | Resend | According to Resend’s published list. A closer function for Taktbygg customer data is not recorded in the reconciliation. | Not fully published by the provider in the reconciliation Frontier has documented | United States, according to Resend | Resend | 27 September 2026 |
| Resend | E-mail and analytics, according to Resend’s list. Not the BigQuery logs through Supabase and not Vercel’s backup. | Not fully published by the provider in the reconciliation Frontier has documented | United States, according to Resend | Resend | 27 September 2026 | |
| Supabase, Inc. | Resend | Database and authentication at Resend, according to Resend’s list. This is not Taktbygg’s Supabase project. | Not fully published by the provider in the reconciliation Frontier has documented | United States, according to Resend | Resend | 27 September 2026 |
| Vercel Inc. | Resend | Server hosting at Resend, according to Resend’s list. This is not function execution in arn1. | Not fully published by the provider in the reconciliation Frontier has documented | United States, according to Resend | Resend | 27 September 2026 |
| Supabase, Inc. | Supabase | Support when Frontier opens a ticket. Not a separate direct contract with Frontier. | Data seen in the support ticket | Not fully published by the provider | Reconciliation of Supabase material | 27 September 2026 |
Names outside the customer’s personal data in the DPA
Names which, according to the provider’s published purpose, are used only for the provider’s own billing, CRM, marketing or similar internal tools are recorded here. Taktbygg has no AI feature of its own. Ordinary service e-mail is sent through Resend’s Emails API. Resend states that this ordinary sending is not sent to Anthropic, and that Anthropic receives content only if the AI Editor or the in-app AI Support Agent is used. Taktbygg does not use those features.
| Actor | Through | Function | Personal data | Geography | Source | Last verified |
|---|---|---|---|---|---|---|
| Attio, Stripe, Slack | Resend | Resend’s own customer relationship with Frontier: billing, CRM or a similar internal tool | Outside the customer’s personal data in this DPA | Not a processing location for Taktbygg customer data | Resend | 27 September 2026 |
| Anthropic | Resend | AI Editor and AI Support Agent. Not used by Taktbygg. Ordinary sending is, according to Resend, not sent here. | No customer content from Taktbygg’s ordinary sending, according to Resend | Not used for Taktbygg’s ordinary sending | Resend | 27 September 2026 |
Changes
Addition or replacement of a direct sub-processor is notified in writing at least 30 days in advance. The customer may object under the data processing agreement. Addition or replacement further down the chain is forwarded as soon as Frontier receives the information. Frontier does not promise more notice than Supabase, Vercel or Resend actually give.
Contact: [email protected]