What This Page Is
To operate Compound we rely on a small set of trusted third-party service providers (“sub-processors”) that may process personal or financial data on our behalf. We publish the current list here for transparency and to support our customers' own compliance reviews. Each provider is bound by a data-processing agreement and is selected for its security posture.
Financial data is encrypted in transit and at rest. Sensitive fields (bank access tokens, account identifiers) are additionally encrypted at the application layer before storage. See our Privacy Policy for how we handle personal data overall.
Current Sub-Processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, edge network, CDN, WAF/DDoS, and primary data storage (Workers, D1, R2, KV, Queues, Vectorize, Workers AI). | All application data at rest (encrypted financial fields, account metadata), request metadata, IP addresses. | United States / global edge |
| Supabase, Inc. | Authentication and identity (magic-link sign-in, session/JWT issuance, MFA). | Email address, authentication identifiers, session metadata. | United States |
| Plaid Inc. | Bank account connectivity and transaction data retrieval. | Bank account connections, balances, and transactions (via tokens encrypted at rest before storage). | United States |
| Paddle.com Market Limited | Merchant of Record, subscription billing and payment processing (consumer and coach plans). | Billing email, payment-method and subscription metadata. Card numbers are handled by Paddle and never touch our servers. | United Kingdom & United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (sign-in, billing, bank, and security notifications) plus opt-in newsletter / product-update email and subscriber-list management. | Recipient email address, email content, subscription preferences, delivery/engagement events. | United States |
| Sanity AS | Content management for marketing/blog content. | Published marketing content only — no customer financial data. | United States / EU |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring (server and worker). | Error/diagnostic events, which may include a user identifier, IP address, and request context. Sensitive fields are scrubbed before transmission. | United States |
| HubSpot, Inc. | Live-chat widget on the public marketing site (homepage, pricing, contact, for-coaches pages). | Chat messages you send, name/email if you provide them in chat, visitor cookie identifiers and page-visit context. No app or financial data — the widget does not run inside the product. | United States |
| RentCast (Realtors Property Resource-independent AVM) | Automated property valuation (AVM) for optional home-value net-worth tracking. | Property street address supplied by the user for the property being valued. Only used when a user opts into automatic home valuation (Compound Plus). | United States |
Changes & Notice
We update this list when we add, remove, or materially change a sub-processor. The “Last updated” date above reflects the most recent change. Business customers who require advance notice of sub-processor changes can request it by emailing hello@makeitcompound.com.
Contact
Make It Compound
Email: hello@makeitcompound.com
Website: makeitcompound.com