Sub-processors
Last updated: 3 May 2026
ALerta uses the following third-party service providers ("sub-processors") to operate the Service. Each sub-processor has signed a Data Processing Agreement (DPA) with us and is bound by GDPR-compliant terms.
We will notify hosts at least 30 days in advance of adding or replacing any sub-processor that processes personal data. Hosts may object to a new sub-processor by contacting privacy@alerta.pt.
Current sub-processors
| Sub-processor | Purpose | Location of processing | DPA |
|---|---|---|---|
| Vercel Inc. | Application hosting and edge delivery | EU (Frankfurt, Germany) | vercel.com/legal/dpa |
| Supabase Inc. | Database, authentication, file storage | EU (Frankfurt, Germany) | supabase.com/legal/dpa |
| Resend (Plus Five Five Inc.) | Transactional email delivery | EU region | resend.com/legal/dpa |
| Google LLC | OAuth authentication (Google Sign-In) | Global; SCCs in place | cloud.google.com/terms/data-processing-addendum |
| SEF / AIMA | SIBA guest data submission (legal obligation, not a commercial sub-processor) | Portugal | Statutory — not contractual |
How to be notified of changes
Email privacy@alerta.pt with the subject line "Subscribe sub-processor updates". You will receive an email at least 30 days before any change takes effect.