About this list
qraft uses a small number of vendors to deliver a reliable SaaS product. The sections below list the providers that may process information on our behalf when you use qraft, along with the role each provider performs. Each provider is bound by their own data processing terms and is engaged only for the purpose described here.
We update this list when a material change happens — for example, when a vendor is added, removed, or has its role changed. Material changes also bump the date above.
Hosting and database
- Vercel Inc. (United States) — application hosting, serverless compute, and global edge network. Vercel processes application requests, log data, diagnostic events, and Vercel Web Analytics aggregate traffic.
- Vercel Blob (United States) — encrypted file storage for uploaded price-list spreadsheets and product images attached to a workspace.
- Neon, Inc. (United States, with data hosted on Amazon Web Services in the Singapore region) — managed PostgreSQL database holding workspace, account, product, quote, and billing records.
Payments and billing
- Stripe Payments Company / Stripe Payments Europe Ltd (United States and Ireland) — subscription billing, invoicing, and payment processing. Card details are entered into Stripe directly and are never stored by qraft.
Email delivery
- Resend, Inc. (United States; uses Amazon Simple Email Service for delivery infrastructure) — transactional email delivery for sign-up confirmation, magic links, billing receipts, and quote-related notifications. Resend processes the recipient email address and the message content.
- Google LLC (Google Workspace) (United States) — corporate inbox for hello@qrafted.co and billing@qrafted.co. Replies and support messages sent to those addresses are received and stored in Google Workspace.
AI processing
When you use AI-assisted features, qraft sends the prompt and the minimum relevant workspace context to the selected AI provider so it can return the requested result. We do not intentionally use customer, product, quote, or prompt content to train public AI models, and we do not sell workspace data.
- OpenAI, L.L.C. (United States) — primary AI provider for Excel mapping, prompt-to-quote drafting, product matching, and follow-up rewrites.
- Anthropic, PBC (United States) — AI provider used when an Anthropic model is selected in the workspace AI settings.
Security and abuse prevention
- Cloudflare, Inc.(United States) — authoritative DNS for qrafted.co and Turnstile bot-detection on the sign-up form. Turnstile receives request signals from the visitor's browser (including IP) but does not store the contents of the sign-up form.
Monitoring and diagnostics
- Functional Software, Inc. d/b/a Sentry (United States) — application error monitoring. The qraft Sentry client is configured to scrub user email addresses and IP addresses from events before they leave the application, and replays, profiling, and tracing are disabled.
Optional analytics (consent-gated)
The provider below is engaged only after a visitor accepts analytics through the cookie banner. If analytics is rejected, qraft does not load this provider for that visitor and attempts to clear any cookies previously set.
- Google LLC (Google Analytics 4) (United States) — aggregate web analytics for the public marketing site.
Optional sign-in (when enabled)
When social sign-in is enabled in the qraft authentication settings, the providers below receive the sign-in request and return basic profile information so qraft can create or match an account. Social sign-in is disabled by default during the pilot phase.
- Google LLC (Google OAuth) (United States).
- LinkedIn Corporation (United States).
International transfers
The providers above are based in the United States or the European Union and may process personal data outside your country of residence. Where required, transfers rely on the provider's standard contractual clauses or other legally recognised transfer mechanisms. Database content is held in the Singapore AWS region by Neon.
Notifications and changes
We update this list when a subprocessor is added, removed, or has its role changed, and we bump the date above. If you would like advance notice of material changes for procurement or DPA review, email hello@qrafted.co and we will add you to the notification list.
Contact
Subprocessor or data-protection questions can be sent to hello@qrafted.co.