Subprocessors
SpAItial Subprocessors
Updated: 3 November 2026
SpAItial Ltd engages the third-party subprocessors below to process customer data on our behalf. This is the complete list. Sign in with Google and Sign in with Apple are not listed because Google and Apple act as independent controllers when you use them. We review vendor security before onboarding. We will update this page when the list changes. Questions: security@spaitial.ai.
Current subprocessors
| Entity | Purpose of processing | Location of processing |
|---|---|---|
| Vercel | Application hosting, TLS termination, web application firewall and request logs | European Union (Germany) |
| Supabase | Database and authentication: account and profile data, prompts and world metadata | European Union (Sweden) |
| Upstash | Cache, rate limiting and real-time job updates | European Union (Germany) |
| Google Cloud | Object storage for customer inputs, generated worlds and captures; batch processing jobs; image captioning (Vertex AI) | United States, European Union |
| Cloudflare | DNS, content delivery, object storage for thumbnails, edited images and temporary API uploads, and our MCP server | United States |
| Modal | GPU inference for world generation | United States |
| fal | Image generation, image editing and image moderation | United States |
| OpenRouter | Routing for text moderation models | United States |
| Inngest | Background job orchestration | United States |
| Stripe | Payment processing. SpAItial does not store card numbers | United States |
| Resend | Transactional email | United States |
| PostHog | Product analytics and error tracking | European Union |
Changes
Material additions to this list will be reflected on this page. Enterprise customers with a signed Data Processing Agreement will be notified as that agreement requires. See also our Security page and Privacy Policy.