Subprocessors
Pipeline Surfer uses a small set of trusted third-party services (subprocessors) to deliver our platform. Each subprocessor is contractually bound to maintain appropriate security and confidentiality standards, and processes customer data only on our instructions and for the purposes described below.
Current subprocessors
| Provider | Purpose | Data processed | Hosting region | Compliance |
|---|---|---|---|---|
| Clerk | User authentication, session management, and SSO / SAML | Account identifiers, email, name, authentication metadata | United States | SOC 2 Type II |
| Vercel | Application hosting, serverless compute, and content delivery | All application and website traffic | United States and global edge | SOC 2 Type II |
| Stripe | Subscription billing and payment processing | Billing contact, payment method, transaction data | United States | SOC 2 Type II, PCI DSS Level 1 |
| InstantDB | Primary data store for pipeline, deal, and workspace data | Customer-entered pipeline data and related metadata | United States | Storage-layer encryption at rest |
Security posture
- Data in transit is encrypted with TLS between your browser, our application, and each subprocessor.
- Data at rest is encrypted at the storage layer by our infrastructure providers.
- Access to production data is limited to authorized Pipeline Surfer personnel.
- Pipeline Surfer is not currently SOC 2 or HIPAA certified as a company. We do not offer a Business Associate Agreement (BAA) and Pipeline Surfer is not intended for the storage or processing of Protected Health Information (PHI).
Updates to this list
We may update this list from time to time as our infrastructure evolves. Material changes will be reflected on this page. If you have questions about our subprocessors or would like to be notified of future changes, contact us at [email protected].