Subprocessors
This list reflects subprocessors active as of the last-updated date, verified against the live system. We will update this list as subprocessors are added or removed, with reasonable advance notice for material additions.
Effective Date: July 9, 2026
Last Updated: August 13, 2026
This page lists the third-party subprocessors that Ficombinator LLC uses to provide the SoloSearcher Service. A subprocessor is any third party that processes personal data on our behalf. All subprocessors are contractually required to process data only as instructed, implement appropriate security measures, and comply with applicable data protection law.
A note on scope: the Service holds no shared company dataset — every company record is private to the user whose workspace it sits in. Company records describe businesses rather than Service users. Two entries below (geocoding) receive only business addresses from those records, and are listed for transparency even though they process no Service user's personal data.
Active Subprocessors
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication & identity | Email, name, session tokens, login metadata | United States |
| Neon, Inc. | PostgreSQL database | All application data at rest (private workspace data encrypted per user) | United States |
| Vercel, Inc. | Application hosting | Request logs, function execution metadata | United States / Global CDN |
| Cloudflare, Inc. (R2) | Object storage | Uploaded documents, encrypted at the application layer before storage | United States |
| Anthropic, PBC | AI analysis (Claude API) | Company data and prompts for analyses you initiate | United States |
| Upstash, Inc. | Rate limiting | Request counters keyed by account/network identifiers — no content | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports with private content redacted before transmission | United States |
| PostHog, Inc. | Product analytics | Allowlisted in-app usage events (no amounts or private deal data); anonymous page analytics on the marketing site | United States |
| U.S. Census Bureau (geocoder) | Geocoding | Business addresses from user workspaces only | United States |
| OpenStreetMap Foundation (Nominatim) | Geocoding fallback | Business addresses from user workspaces only | EU |
Subprocessor Details
Clerk, Inc.
Purpose: Authentication, session management, MFA, and invitation/waitlist gating.
Data Processed: email address, display name, session tokens and device identifiers, login timestamps, IP addresses, user agents, MFA enrollment status. Passwords, where used, are stored by Clerk — never by us.
Location: United States · Certification: SOC 2 Type II
DPA / Terms: Clerk DPA · Clerk Privacy Policy
Neon, Inc.
Purpose: Primary PostgreSQL database; all application data at rest.
Data Processed: your private workspace rows — every company record and everything attached to it. Sensitive private content (document ciphertext references, extracted financials) is encrypted with your per-user key at the application layer; database row-level security restricts the application's read/write role to the requesting account's rows.
Location: United States · Certification: SOC 2 Type II
DPA / Terms: Neon DPA · Neon Privacy Policy
Vercel, Inc.
Purpose: Application hosting, serverless functions, CDN.
Data Processed: HTTP request metadata (URL, status, IP, user agent), function execution logs. Application logs are written to avoid private deal content by policy and by redaction helpers.
Location: United States / Global CDN · Certification: SOC 2 Type II
DPA / Terms: Vercel DPA · Vercel Privacy Policy
Cloudflare, Inc. (R2)
Purpose: Object storage for uploaded documents.
Data Processed: documents you upload (CIMs, financial statements). Files are sealed with application-layer encryption before storage, in addition to R2's own at-rest encryption; objects are purged on account deletion.
Location: United States · Certification: SOC 2 Type II, ISO 27001
DPA / Terms: Cloudflare DPA · Cloudflare Privacy Policy
Anthropic, PBC
Purpose: AI analysis (Claude API) — document extraction and analysis skills you initiate.
Data Processed: company data, document content, and prompts for the specific analysis you run. Anthropic does not use API-submitted data for model training under its standard API terms. Invocations are logged on our side with cost metadata only.
Location: United States
DPA / Terms: Anthropic Commercial Terms · Anthropic Privacy Policy
Upstash, Inc.
Purpose: Redis-backed rate limiting and abuse prevention.
Data Processed: request counters keyed by account ID, API-key prefix, or network address. Counters only — no user content is stored.
Location: United States · Certification: SOC 2 Type II
DPA / Terms: Upstash DPA · Upstash Privacy Policy
Functional Software, Inc. (Sentry)
Purpose: Application error monitoring.
Data Processed: error reports (stack traces, request context). Our integration redacts private deal content and personal data from events before transmission.
Location: United States · Certification: SOC 2 Type II
DPA / Terms: Sentry DPA · Sentry Privacy Policy
PostHog, Inc.
Purpose: Product analytics (reintroduced after the v1 removal).
Data Processed: in-app usage events keyed by account identifier under a strict property allowlist — no dollar amounts, document content, or private deal data; on the public marketing site, anonymous cookieless page analytics only. No advertising use.
Location: United States · Certification: SOC 2 Type II
DPA / Terms: PostHog DPA · PostHog Privacy Policy
U.S. Census Bureau geocoder & OpenStreetMap Nominatim
Purpose: Converting business street addresses to map coordinates for radius search.
Data Processed: business addresses only, taken from company records in users' workspaces. Nothing identifies the user: no account data, and no notes, documents, financials, contacts, or other workspace content beyond the business address itself. Nominatim usage follows the OSM Foundation's usage policy (throttled, attributed).
Location: United States (Census) / EU (OSMF)
Removed and Residual Subprocessors
The following subprocessors are no longer in use and no longer receive data: Intuit/QuickBooks (integration retired), Brave Software (research enrichment — retired from the product; any future operator-side research tooling will be re-listed if it processes personal data), Hunter.io (email discovery — retired with the outreach feature set). PostHog was removed in v1 and later reintroduced; it is listed above as an active subprocessor.
Stripe, Inc. — retired from active use, residual data retained
Stripe left the active list in v3 (2026-08-13). The Service is free of charge and processes no payments, so no data is sent to Stripe and none will be. Calling Stripe simply "removed" would nonetheless overstate it, so the residue is described here:
- Founding-member reservations. Where someone completed card verification for a founding reservation, four payment-derived fields remain alongside that waitlist entry: Stripe's customer identifier, a verification timestamp, a card fingerprint, and the founding-member rank. Card numbers never reached our servers.
- Stripe remains a processor of that residual data. The corresponding customer and setup-intent objects may still exist in our Stripe account, and Stripe's own retention terms apply to its copy. Storage is processing; we do not claim otherwise.
- Purpose and review. We keep our copy solely to honour and evidence the founding-member commitment made to those people. We review this retention at least annually and delete what is no longer needed.
- No charge was ever made. The reservation flow authorised nothing and charged nothing, and the Service has never billed anyone.
To have a founding-reservation record deleted, email privacy@solosearcher.com. We delete our copy and the corresponding Stripe objects together.
Version: v3 · Last updated: 2026-08-13 — Stripe removed; the Service is free of charge. Supersedes v2 (2026-08-05).