Subprocessors
Last updated: August 19, 2026
Surface Labs, Inc. (“Surface”) engages the third-party subprocessors listed below to help deliver its services. A subprocessor is a third party that processes personal data on Surface's behalf in connection with providing the services to our customers.
The tables below identify each subprocessor, the purpose of its processing, and where that processing takes place. This page reflects our current subprocessors and is maintained as our services evolve.
Customers who have entered into a Data Processing Agreement with Surface may subscribe to notifications of changes to this list as set out in that agreement.
Infrastructure and platform
Amazon Web Services, Inc.
- Purpose
- Cloud infrastructure and hosting
- Location
- United States
Vercel, Inc.
- Purpose
- Application hosting and deployment
- Location
- United States
Cloudflare, Inc.
- Purpose
- CDN, edge network, and DDoS protection
- Location
- United States / Global
Supabase, Inc.
- Purpose
- Database and authentication
- Location
- United States
Upstash, Inc.
- Purpose
- Cache and message queue (Redis)
- Location
- United States
Trigger.dev Ltd.
- Purpose
- Background jobs and workflow orchestration
- Location
- United States
| Subprocessor | Purpose of processing | Processing location |
|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure and hosting | United States |
| Vercel, Inc. | Application hosting and deployment | United States |
| Cloudflare, Inc. | CDN, edge network, and DDoS protection | United States / Global |
| Supabase, Inc. | Database and authentication | United States |
| Upstash, Inc. | Cache and message queue (Redis) | United States |
| Trigger.dev Ltd. | Background jobs and workflow orchestration | United States |
Data enrichment and validation
Used to enrich lead records and validate contact data in connection with providing the services.
MaxMind
- Purpose
- Geolocation
- Location
- United States
ZeroBounce
- Purpose
- Email validation
- Location
- United States
MillionVerifier
- Purpose
- Email validation
- Location
- Hungary / European Union
Apollo
- Purpose
- B2B contact and company data
- Location
- United States
Exa
- Purpose
- Web search and research
- Location
- United States
| Subprocessor | Purpose of processing | Processing location |
|---|---|---|
| MaxMind | Geolocation | United States |
| ZeroBounce | Email validation | United States |
| MillionVerifier | Email validation | Hungary / European Union |
| Apollo | B2B contact and company data | United States |
| Exa | Web search and research | United States |
AI model providers
Used to power Surface's AI features, including lead scoring, enrichment, and agent workflows.
OpenAI, LLC
- Purpose
- Large language model inference
- Location
- United States
Anthropic, PBC
- Purpose
- Large language model inference
- Location
- United States
| Subprocessor | Purpose of processing | Processing location |
|---|---|---|
| OpenAI, LLC | Large language model inference | United States |
| Anthropic, PBC | Large language model inference | United States |
Analytics and internal operations
PostHog, Inc.
- Purpose
- Product analytics
- Location
- United States
Slack Technologies, LLC
- Purpose
- Internal notifications and communications
- Location
- United States
| Subprocessor | Purpose of processing | Processing location |
|---|---|---|
| PostHog, Inc. | Product analytics | United States |
| Slack Technologies, LLC | Internal notifications and communications | United States |
Model providers and training
Model training
Changes to this list
Surface may update its subprocessors from time to time. For customers with a Data Processing Agreement in place, Surface will provide notice of additions to this list, and an opportunity to object, in accordance with the terms of that agreement.
Questions
For questions about this list or Surface's data processing practices, contact privacy@withsurface.com.