Skip to content
TheGonch
Sign inRequest a walkthrough
Trust · Sub-processors

Sub-processors

Last updated · September 2026Authoritative list · referenced by the Privacy Policy

A sub-processor is a third party that processes firm or website data on TheGonch’s behalf in order to run the service. TheGonch keeps this list short on purpose. Each row states what the provider does, what data passes through it, and what is known about where it processes that data.

Current providers

ProviderPurposeData / processingRegion / documentation
SupabaseDatabase · auth · storageManaged Postgres hosting the primary database, with row-level security. Authentication and session management. File storage where used.All firm platform data and user accounts. Encrypted at rest by the provider.AWS us-east-1 (Northern Virginia)Confirmed for the primary database
Amazon Web ServicesUnderlying cloudThe cloud infrastructure on which the Supabase-managed database runs. Not contracted directly by TheGonch.Same data as Supabase, at the infrastructure layer.us-east-1 (Northern Virginia)Confirmed for the primary database
VercelApplication hostingHosts and serves the web application and its server-side functions for both thegonch.com and the platform. Terminates TLS.Requests and responses in transit, including platform data as it is displayed. Ordinary request logs. Website enquiry form submissions pass through here.Processing region to be confirmedEdge network is global by design; server-function region under confirmation
ResendContact-form notificationsDelivers the internal notification email when website enquiries are submitted and email delivery is configured. It is not the platform’s advisor sign-in email service.Name, work email, firm, role, advisor count and message submitted in the contact form.Processing region to be confirmedEmail-delivery integration; region not verified
Browser push servicesApple, Google or MozillaRelays device notifications through the subscriber’s browser vendor. Used only when the user opts in to notifications.Device endpoint and an encrypted notification payload.Processing region to be confirmedProvider depends on the subscriber’s browser
Account email deliveryCategory · provider to be listedAccount email delivery, where used through the authentication service. Provider configuration remains to be confirmed.Recipient email address and account-message content.Provider and region to be confirmedListed here as a category until named

Rows marked “to be confirmed” are stated as such rather than assumed. They will be updated when confirmation is complete.

A note on residency

“US-hosted primary database” means exactly that: the database. It does not mean that every sub-processor processes data in the United States. Application hosting uses a global edge network, and email and push providers’ processing regions are not yet confirmed. Firms with a residency requirement should read this table row by row rather than relying on the database statement alone.

Deliberately absent

Some categories of tooling common on software websites and in software products are not used by TheGonch, and their absence from this list is intentional:

Advertising analyticsNo advertising pixels or ad-network tags on the website or in the platform.
Cross-site trackingNo third-party tracking cookies or fingerprinting.
Behavioural analytics on platform dataNo third-party product-analytics service receives firm operating data.

Changes

When a provider is added, removed or confirmed, this page and its date are updated and firms with an active deployment are told directly. Questions about a specific provider can be raised through the contact page or in a technical review.