Notice
How this list changes
Material subprocessor changes are emailed to active paid users at least 30 days before they take effect. Removed vendors are reflected here after production traffic has stopped flowing to that vendor.
A DPA review path is available on request for institutional buyers. This page should not be read as a promise that every buyer-specific DPA, MSA, insurance request, or security questionnaire has already been completed.
Active vendors
Current subprocessor list
| Provider | Purpose | Data | Region/status |
|---|---|---|---|
| Supabase | Authentication and primary database | Account identity, profile, preferences, sessions, MFA factors, passkeys, saved account records, and saved Marco conversations | Project region us-east-1, subject to the notice process if changedService-role use is server-side and allow-listed. |
| Vercel | Application hosting, serverless runtime, and edge delivery | Request metadata, IP address, user agent, URL, response status, and runtime logs | Global edge with primary functions in us-east-1Structured application logs are sanitized before sensitive values are attached. |
| Upstash Redis | Distributed rate limiting and cache storage when configured | Rate-limit keys, IP-derived buckets, counters, reset timestamps, and public macro cache payloads | USA/global depending on the configured databaseNo request bodies are intentionally stored for rate limiting. |
| Anthropic | Marco assistant model provider | Assistant messages, page path, source context, tier/model metadata, limited profile context, and explicit saved-object summaries when the user asks for them | USA/global under the API processing pathCommercial API and DPA status must be reviewed before regulated or institutional promises are made. |
| Stripe | Payments, subscriptions, invoicing, and customer portal | Email, name, billing address, payment-method tokens, invoice records, and subscription metadata | Global, with primary controls in the USAStripe tokenizes card details; Macro by Mark does not store full card numbers. |
| Resend | Transactional email | Email address, delivery metadata, and the message content needed for sign-in alerts, password flows, and notifications | USAPer-recipient throttles are used for sign-in alerts. |
| Cloudflare | Turnstile bot challenge and DNS | IP address, browser context, and challenge solve evidence | GlobalTurnstile handles bot-mitigation metadata, not product content. |
| OAuth identity provider | Email, name, profile picture URL, and Google subject claim | GlobalOAuth scopes are limited to openid, email, and profile. | |
| Trigger.dev | Background job runtime for ingestion and lab pipelines | Indicator catalog data, lab run results, queue metadata, and job state | USA/global under the configured Trigger.dev workspaceNo platform-user PII is intentionally sent through Trigger.dev today. |
| Tiger Cloud / Timescale | Time-series storage for the macroeconomic indicator discovery catalog | Public macroeconomic catalog metadata and observation rows | USA/global under the configured databaseUsed for public macro data, not platform-user PII. |
| Sentry | Error monitoring when configured | Stack traces, user id, URL, and basic request metadata after redaction | USA/global under the configured Sentry projectOnly active when SENTRY_DSN is configured. |
Review path
Vendor and privacy questions
Vendor-security and institutional procurement questions can be sent to security@macrobymark.com. Privacy and subprocessor questions can be sent to privacy@macrobymark.com.
Primary references
Sources that informed the current posture. Included for transparency; this doesn't turn the page into legal advice.
Related policies
The other pages that round out the trust posture for Macro by Mark.
Privacy Policy
How browser storage, account sync, watchlists, dashboards, and operational telemetry are handled.
Cookie Policy
Required cookies, optional analytics, consent refresh, and Global Privacy Control handling.
Privacy Choices
Export, correction, deletion, cookie controls, GPC handling, and manual request paths.
Terms of Use
The usage rules, no-advice framing, intellectual-property boundaries, and service protections for the site.
Acceptable Use Policy
Security boundaries, automation limits, sanctions posture, source-use rules, and enforcement paths.
Refund Policy
Subscription cancellation, default non-refundability, trial-conversion review, and support request path.
Contracts
DPA, MSA, order-form, security review, insurance, and institutional buyer request paths.
Copyright
Copyright, attribution, source-credit, takedown, provider-rights, and DMCA-agent status.
SOC 2 Path
Current non-attested status, mapped runbooks, open evidence gaps, and buyer review path.
Public Status
Manual incident-communication posture, tracked service areas, and support/security channels.
Legal Changelog
Current public index of legal, privacy, security, and trust-policy updates.
Ethics & Compliance
Source transparency, no-endorsement posture, model restraint, and research-integrity guardrails.
Accessibility Statement
The accessibility posture, current limitations, and how to report a barrier or request an accommodation.