Legal
Subprocessors
UAB Silotech uses the providers below to run Formius. Each one processes personal data only to provide its service to us, under a data processing agreement. This list is part of our Data Processing Agreement.
- Last Updated:
- September 28, 2026
- Contact:
- privacy@silotech.xyz
| Provider | Purpose | Data it receives | Location | DPA |
|---|---|---|---|---|
| Supabase | Database, file storage and admin sign-in (one-time email codes) | All customer data: account email, form definitions, form responses, respondent email addresses, uploaded files (including ID document images), IP address and browser user agent of submissionsReceives form respondent data | EU (Frankfurt, Germany, AWS eu-central-1) | Supabase DPA |
| Vercel | Application hosting, serverless functions and scheduled jobs | All requests to the application pass through it, including form responses in transit, IP addresses and request logsReceives form respondent data | EU or US, per provider DPA | Vercel DPA |
| Upstash (Vercel KV) | Key value store behind Vercel KV, used for rate limiting and short-lived AI form generation state | Short-lived rate-limit counters keyed by IP address or email address, and for about 5 minutes the prompt and form structure of an AI form generation in progress. No form answersReceives form respondent data | EU or US, per provider DPA | Upstash (Vercel KV) DPA |
| Resend | Transactional email: submission confirmation links to respondents, and new response and form deletion emails to form owners | Recipient email address, form title and the confirmation link. Form answers are not included in emailsReceives form respondent data | EU or US, per provider DPA | Resend DPA |
| PostHog | Product analytics | Usage events from signed-in customers. On public form pages: anonymous page and progress events, with nothing stored on the respondent device. For each submission: counts and the domain part of the respondent email address (for example "example.com"), with IP geolocation disabled on server events. Form answers are not sentReceives form respondent data | EU (PostHog EU Cloud) | PostHog DPA |
| Sentry | Error monitoring | Technical error reports, which can include the page address, browser details and diagnostic context such as account user IDs and form IDs. Default personal data collection is off; before sending, cookies and authorization headers are removed, email addresses are masked in error messages and diagnostic context, IP addresses and user agents in diagnostic context are removed, and error session replays mask all text and block all media | EU or US, per provider DPA | Sentry DPA |
| Stripe | Subscription billing, checkout, tax and customer portal | Customer billing details entered at checkout (name, email address, payment method, billing address). No respondent data | EU or US, per provider DPA | Stripe DPA |
| Anthropic | AI form generation and editing, and the fallback model for lesson text generation | The prompt the customer writes, the form structure being edited and the lesson request the customer writes. No respondent data | EU or US, per provider DPA | Anthropic DPA |
| Vercel AI Gateway | Routing of AI model requests for lesson generation, lesson answer feedback and, when configured, form generation | Customer prompts and lesson content; for optional lesson feedback, the learner answer, the lesson question and the saved rubric, without the learner email addressReceives form respondent data | EU or US, per provider DPA | Vercel AI Gateway DPA |
| OpenAI (through Vercel AI Gateway) | Lesson text generation, and optional AI feedback on lesson answers | The lesson request the customer writes; for optional feedback, the learner answer, the lesson question, the saved rubric and reference material, without the learner email address or other form responsesReceives form respondent data | EU or US, per provider DPA | OpenAI (through Vercel AI Gateway) DPA |
| Google Gemini (through Vercel AI Gateway) | Lesson illustration generation and validation | Lesson prompts written by the customer. No respondent data | EU or US, per provider DPA | Google Gemini (through Vercel AI Gateway) DPA |
Transfers outside the EEA
Form responses and uploaded files are stored in the EU (Frankfurt, Germany). Where a provider above processes personal data outside the EEA, for example in the United States, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, included in that provider's DPA.
Changes to this list
We announce a new or replacement subprocessor at least 30 days before it starts processing customer data, by updating this page and emailing account owners. Customers can object during that period, as described in section 8 of the DPA.