Notice
How this list changes
Material subprocessor changes are emailed to active paid users at least 30 days before they take effect. Removed vendors are reflected here after production traffic has stopped flowing to that vendor.
A DPA review path is available on request for institutional buyers. This page should not be read as a promise that every buyer-specific DPA, MSA, insurance request, or security questionnaire has already been completed.
Active vendors
Current subprocessor list
| Provider | Purpose | Data | Region/status |
|---|---|---|---|
| Supabase | Authentication and primary database | Account identity, profile, preferences, sessions, MFA factors, passkeys, saved account records, and saved Marco conversations | Project region us-east-1, subject to the notice process if changedService-role use is server-side and allow-listed. |
| Vercel | Application hosting, serverless runtime, and edge delivery | Request metadata, IP address, user agent, URL, response status, and runtime logs | Global edge with primary functions in us-east-1Sensitive values are not intentionally attached to logs; structured redaction is applied on guarded paths while the remaining console-callsite migration is completed. |
| Amazon Web Services (AWS) | Hosted Macro Lab job queue, worker compute, and private artifact storage | Lab run identifiers and job metadata, user-provided input bundles, execution logs and results, and generated artifacts for hosted Macro Lab runs | Primary Macro Lab resources in us-east-2Private S3 objects and queue payloads use the production encryption and retention controls documented in the Macro Lab operations runbook. |
| Upstash Redis | Distributed rate limiting and cache storage when configured | Rate-limit keys, IP-derived buckets, counters, reset timestamps, public macro cache payloads, and cached query-derived embedding vectors | USA/global depending on the configured databaseNo request bodies are intentionally stored for rate limiting. Query-derived embedding vectors may be cached for up to 24 hours where supported; cache keys hash the normalized query text. |
| Anthropic | Marco assistant model provider | Assistant messages, page path, source context, tier/model metadata, limited profile context, and explicit saved-object summaries when the user asks for them | USA/global under the API processing pathCommercial API and DPA status must be reviewed before regulated or institutional promises are made. |
| OpenAI | Semantic search and content-retrieval embeddings | Normalized user search or assistant query text, public indicator and content chunk text, and generated embedding vectors | USA/global under the API processing pathUsed for embedding generation; Anthropic remains the model provider for Marco assistant responses. |
| Stripe | Payments, subscriptions, invoicing, and customer portal | Email, name, billing address, payment-method tokens, invoice records, and subscription metadata | Global, with primary controls in the USAStripe tokenizes card details; Macro by Mark does not store full card numbers. |
| Resend | Transactional email | Email address, delivery metadata, and the message content needed for sign-in alerts, password flows, and notifications | USAPer-recipient throttles are used for sign-in alerts. |
| Cloudflare | Turnstile bot challenge and DNS | IP address, browser context, and challenge solve evidence | GlobalTurnstile handles bot-mitigation metadata, not product content. |
| OAuth identity provider | Email, name, profile picture URL, and Google subject claim | GlobalOAuth scopes are limited to openid, email, and profile. | |
| Trigger.dev | Background job runtime for ingestion and lab pipelines | Indicator catalog data, user UUIDs and lab/job metadata, lab run results, queue metadata, and job state | USA/global under the configured Trigger.dev workspaceUser identifiers and results are limited to the active job workflows that require them. |
| Tiger Cloud / Timescale | Time-series storage for the macroeconomic indicator discovery catalog | Public macroeconomic catalog metadata and observation rows | USA/global under the configured databaseUsed for public macro data, not platform-user PII. |
Review path
Vendor and privacy questions
Vendor-security and institutional procurement questions can be sent to security@macrobymark.com. Privacy and subprocessor questions can be sent to privacy@macrobymark.com.
Primary references
Sources that informed the current posture. Included for transparency; this doesn't turn the page into legal advice.
Related policies
The other pages that round out the trust posture for Macro by Mark.
Privacy Policy
How browser storage, account sync, watchlists, dashboards, and operational telemetry are handled.
Cookie Policy
Required cookies, optional analytics, consent refresh, and Global Privacy Control handling.
Privacy Choices
Export, correction, deletion, cookie controls, GPC handling, and manual request paths.
Terms of Use
The usage rules, no-advice framing, intellectual-property boundaries, and service protections for the site.
Acceptable Use Policy
Security boundaries, automation limits, sanctions posture, source-use rules, and enforcement paths.
Refund Policy
Subscription cancellation, default non-refundability, trial-conversion review, and support request path.
Contracts
DPA, MSA, order-form, security review, insurance, and institutional buyer request paths.
Copyright
Copyright, attribution, source-credit, takedown, provider-rights, and DMCA-agent status.
SOC 2 Path
Current non-attested status, mapped runbooks, open evidence gaps, and buyer review path.
Public Status
Manual incident-communication posture, tracked service areas, and support/security channels.
Legal Changelog
Current public index of legal, privacy, security, and trust-policy updates.
Ethics & Compliance
Source transparency, no-endorsement posture, model restraint, and research-integrity guardrails.
Accessibility Statement
The accessibility posture, current limitations, and how to report a barrier or request an accommodation.