Subprocessors

Honest list for procurement. Customer VPC deployments run these on their metal.

Component	Purpose	Data
Self-hosted Supabase	Auth, RLS, audit, credits	Operator accounts, ledger
KumoMTA	SMTP inject / delivery	Message envelopes (your VPC)
Stripe (optional)	Credit packs if enabled	Billing metadata only
Google Fonts (marketing)	Typography CDN	IP to Google if not self-hosted