Subprocessors and Service Providers
Last updated: August 28, 2026
This list describes providers used by Closyn LLC d/b/a Crispy.
Status of this list
Crispy uses the providers below to operate the service. A provider's role can differ by activity: some act as subprocessors for customer-controlled data, while others process controller data for Crispy. Contract status and international-transfer status are still pending verification for every provider listed on this page. A named provider is not a representation that a DPA, Standard Contractual Clauses, UK Addendum, or other transfer instrument has already been executed. A DPA is available upon request and becomes effective only through valid execution or incorporation into a binding agreement.
Operational providers
| Vendor | Service | Data categories | Region |
|---|---|---|---|
| Supabase Inc. | Database, authentication, storage, and row-level access control | Account, contacts, messages, campaigns, usage, billing, support, and security data | Pending verification |
| Google LLC | User-selected Google OAuth authentication | Account, device, and security data | Global |
| GitHub, Inc. | User-selected GitHub OAuth authentication | Account, device, and security data | Global |
| Railway Corp. | Application hosting and request processing | Account, LinkedIn session, contacts, messages, campaigns, usage, billing, support, security, and device data | Pending verification |
| Cloudflare, Inc. | CDN, security, traffic processing, email protection, and analytics where enabled | Device and security data | Global |
| ipapi.co counterparty pending verification | IP-to-country lookup fallback when an edge country header is unavailable | IP address and resulting country code | Pending verification |
| LinkedIn connection infrastructure provider | LinkedIn account connection and API infrastructure | LinkedIn session, contacts, messages, campaigns, and account data | Pending verification |
| Stripe, Inc. | Checkout, payments, subscriptions, invoices, refunds, and billing portal | Account, billing, and device data | Global |
| Resend, Inc. | Transactional and permitted marketing email delivery | Account, support, and usage data | Pending verification |
| Functional Software, Inc. (Sentry) | Error, performance, trace, and sampled error-replay monitoring | Security, device, and account data; generated content payloads identified in this review were removed | Pending verification |
| Slack counterparty pending verification | Operational support, campaign, fraud/security, billing, referral/commission, AI-spend, and business-metric notifications | Account, support, campaign, security, billing, and usage data | Pending verification |
| Upstash, Inc. | Rate limiting and Redis infrastructure | Usage and security data | Pending verification |
| PostHog, Inc. | Consent-gated browser analytics plus server-side operational product events; browser replay, surveys, and autocapture are disabled in the current integration | Device, account, and usage data | Pending verification |
| Inngest Inc. | Durable workflows and scheduled-job orchestration | Account, contacts, messages, campaigns, usage, and security data | Pending verification |
| Anthropic, PBC | Scheduled and event-triggered conversation labeling, inbox intelligence, intent and sentiment tagging, writing-style analysis, content suggestions, and user-invoked AI analysis | Messages, contacts, campaign content, and account context | Pending verification |
| Prospeo (legal entity pending verification) | Person enrichment for an explicitly requested LinkedIn profile audit | Submitted LinkedIn profile URL and returned professional profile data | Pending verification |
| ElevenLabs counterparty pending verification | Optional user-configured integration | Encrypted user-supplied API credential and content submitted when the integration is used | Pending verification |
| Closyn LLC (internal ShyftOS system) | Cross-product portfolio operations database | Prospect email/source, customer relationship, billing, revenue, and referral data | Pending verification |
Advertising and measurement platforms
Crispy has the capability to integrate the platforms below for conversion measurement and retargeting. They are listed for transparency but are not necessarily active on every visit or a subprocessor in every legal context. Intended activation requires a configured deployment identifier and marketing consent. Consent-gating and final configuration are still being completed. These platforms may act under their own terms as independent or joint controllers for some advertising activities.
| Vendor | Service | Data categories | Region |
|---|---|---|---|
| Meta Platforms, Inc. | Advertising measurement and retargeting when enabled and consented | Device and account data | Global |
| LinkedIn Corporation | Advertising measurement and retargeting when enabled and consented | Device and account data | Global |
| Google LLC | Analytics and advertising measurement when enabled and consented | Device and account data | Global |
| TikTok Inc. | Advertising measurement and retargeting when enabled and consented | Device and account data | Global |
| X Corp. | Advertising measurement and retargeting when enabled and consented | Device and account data | Global |
| Reddit, Inc. | Advertising measurement and retargeting when enabled and consented | Device and account data | Global |
Important processing details
- The LinkedIn connection infrastructure provider receives connection material and supports connected-account API operations. Its identity is available to customers through the DPA and compliance-request process.
- Supabase, Railway, and Inngest can process managed contacts, messages, campaigns, and related activity; Crispy is not merely a real-time pass-through.
- Anthropic receives content for both automatic service features and analysis explicitly invoked by a user, as described above.
- PostHog browser collection is consent-gated. Separately, server-side operational events may run under legitimate interests and can include device, account, and usage identifiers; neither lane is described as anonymous.
- Slack receives the operational alert categories listed above, and ShyftOS receives the internal Closyn prospect and portfolio projections described above.
- Sentry has credential-redaction controls, but Crispy does not claim that every item of personally identifiable information is always scrubbed before transmission.
Questions and updates
We will update regions, contract status, transfer mechanisms, and provider changes as they are verified. Questions or requests for subprocessor notices can be sent to [email protected].