Back to Legal
Sub-Processors
The following third-party services process customer data on behalf of Cursus. Customers are notified at least 30 days before any sub-processor changes take effect.
| Sub-processor | Purpose | Data Processed | Location | Website |
|---|---|---|---|---|
| Supabase | Database hosting, authentication, file storage | User accounts, application data, uploaded files, session tokens | United States (AWS) | supabase.com |
| Vercel | Application hosting, edge functions, serverless compute | HTTP requests, application logs, deployment artifacts | United States (AWS/GCP) | vercel.com |
| Anthropic | AI processing for Lumen copilot | Conversational prompts, contextual organizational data provided to AI features | United States | anthropic.com |
| Resend | Transactional email delivery | Recipient email addresses, email content, delivery status | United States | resend.com |
| Cloudflare | CDN, DDoS protection, email routing | HTTP request metadata, IP addresses, DNS queries | Global | cloudflare.com |
| PostHogOptional | Product analytics, if enabled by customer | Anonymized usage events, feature flag evaluations, session metadata | EU / United States | posthog.com |
Change notification policy: Cursus will notify customers at least 30 days before adding, removing, or replacing any sub-processor. Notifications are sent to the organization admin email on file. If you object to a sub-processor change, contact us at privacy@cursusapp.io.
Last updated: April 5, 2026.