Subprocessors

Third-party services that touch platform data, what each receives, and why.

Service	Role	Data it touches
DigitalOcean	Cloud hosting for the application and its storage	All application data at rest and in transit within the hosting environment
Resend	Transactional email delivery	Recipient email addresses and the content of account emails (verification, password reset, collaboration invitations)
Google (OAuth)	Optional sign-in	The identifiers Google shares to authenticate a user who chooses Google sign-in
Google (reCAPTCHA v3)	Optional bot protection on response collection	Device and interaction signals Google uses to score the request, only on surveys whose researcher enabled it
jsDelivr	Content-delivery network for static browser libraries	Serves public JavaScript and CSS files to browsers, receives the requester's IP as any web host does, all files are version-pinned with integrity hashes

No service in this list receives survey response content except the hosting provider, on whose infrastructure the platform runs.

This list changes only with a deliberate operational decision, material changes are reflected here and in the Privacy Policy.