Sub-processor Inventory
Every third party that processes your data on our behalf
CapsuLabs engages the sub-processors below to deliver the Services. Per GDPR Art. 28(2), the published DPA, and the Partnership Liability Addendum §8, customers receive ≥ 30 days' advance written notice of any addition or material change.
Stay notified
Get advance notice of sub-processor changes.
Email legal@capsulabs.co.il with the subject line "Subscribe to sub-processor updates", and we'll add you to the notification list.
Active Sub-processors
Supabase Inc.
Postgres database, authentication, object storage, edge functions
Region
India, AWS ap-south-1 (Mumbai)
Transfer mechanism
Transfer of Data Abroad Regs, 5761-2001, basis pending counsel
Data categories
Account data · inspection records · uploaded media · audit logs
Anthropic PBC
Claude: site assistant replies, report drafting, lead research, furnishing suggestions, call summarisation
Region
United States
Transfer mechanism
Vendor DPA
Data categories
Assistant messages · report narrative inputs · lead context · call transcripts
ElevenLabs Inc.
Speech-to-text transcription of inbound call recordings (Scribe v1)
Region
United States
Transfer mechanism
Vendor DPA
Data categories
Call audio · resulting transcripts
Twilio Inc.
Inbound and outbound voice telephony, call routing and recording
Region
United States
Transfer mechanism
Vendor DPA · SCCs
Data categories
Caller phone numbers · call metadata · recordings
Google LLC
Gmail API for outbound transactional email · Google OAuth sign-in
Region
EU / US
Transfer mechanism
EU-US Data Privacy Framework · SCCs
Data categories
OAuth tokens · recipient email addresses · message content
PayPlus Ltd.
Payment-link creation and settlement callbacks
Region
Israel
Transfer mechanism
Domestic, no cross-border transfer
Data categories
Payer name · amount · order reference · payment status
Expo (650 Industries, Inc.)
Push notification delivery to the mobile app
Region
United States
Transfer mechanism
Vendor DPA
Data categories
Device push tokens · notification title and body
Cloudflare, Inc.
Turnstile bot challenge on public forms
Region
Global anycast network
Transfer mechanism
SCCs
Data categories
IP addresses · request fingerprints · challenge tokens
Esri (ArcGIS Online)
Satellite and street map tile imagery embedded in reports
Region
United States
Transfer mechanism
Vendor terms
Data categories
Map-tile requests derived from the property location
OpenStreetMap Foundation
Nominatim geocoding, Overpass building footprints, map tile layer
Region
European Union / United Kingdom
Transfer mechanism
Public service, no DPA; requests contain the property address
Data categories
Property address strings · coordinate lookups
Open-Meteo
Weather and outdoor air-quality data for the property location
Region
European Union (Germany)
Transfer mechanism
Public service, coordinates only, no personal identifiers
Data categories
Latitude / longitude of the inspected property
Certified mycology partner labs
qPCR / ERMI / culture analysis of physical samples
Region
EU / Israel, specific lab named on each report
Transfer mechanism
SCCs where cross-border applies
Data categories
Sample metadata · property address · result data
Objection Procedure
Where a Customer reasonably objects to a new sub-processor on security or data-protection grounds during the 30-day notice window, CapsuLabs will:
- Discuss the concern in good faith with the Customer's designated security or DPO contact;
- Either decline to engage the proposed sub-processor for the Customer's data, implement compensating controls satisfactory to the Customer, or (if no resolution is reached) allow the Customer to terminate the affected service line without penalty effective on the proposed change date.
Customers under a Partnership Liability Addendum should refer to §8 of that document for the contractual mechanic.
This page is updated whenever the inventory changes. Last reviewed: [date pending]. For procurement-team queries, contact legal@capsulabs.co.il.
Cookies on this site
We store only what the site needs to work: keeping you signed in, remembering your language, and checking you're not a bot. We also run Google's advertising tag on every page, to tell which ads bring people here. Until you allow it, that tag stores nothing on your device and sends Google only a basic, cookie-free signal. Allowing all lets it use cookies too. Cookie Policy · Privacy Policy