Trust & legal
Subprocessors & Infrastructure
These are the external services present in the current FiloSpace authentication, database, and file-storage architecture.
Last updated: August 12, 2026
1. Current providers
| Provider | Purpose | Data involved | Documentation |
|---|---|---|---|
| Supabase, Inc. | Authentication and PostgreSQL database services. | Account identity, profiles, file metadata, folders, tags, shares, jobs, and activity. | Privacy DPA |
| Amazon Web Services, Inc. | Private Amazon S3 object storage. | Uploaded file contents, generated files, object keys, and storage operations. | Privacy DPA information |
| Google LLC | Optional Google OAuth sign-in selected by the user. | Email, name, profile image, OAuth identifiers, and authentication events. | Privacy |
Supabase, Inc.
- Purpose
- Authentication and PostgreSQL database services.
- Data involved
- Account identity, profiles, file metadata, folders, tags, shares, jobs, and activity.
Amazon Web Services, Inc.
- Purpose
- Private Amazon S3 object storage.
- Data involved
- Uploaded file contents, generated files, object keys, and storage operations.
- Documentation
- PrivacyDPA information
Google LLC
- Purpose
- Optional Google OAuth sign-in selected by the user.
- Data involved
- Email, name, profile image, OAuth identifiers, and authentication events.
- Documentation
- Privacy
2. Processing locations
The current S3 object bucket is configured for AWS Europe (Stockholm), eu-north-1. The Supabase project region is not declared in this repository, and Google authentication may involve global systems. Provider operational, support, security, and account data may be processed outside the primary service region.
This page does not promise that all information remains in one country or region. Review provider documentation and your deployment configuration when assessing location or transfer requirements.
3. Provider changes
This list will be updated before a new provider begins processing customer data for a materially different purpose. The last-updated date identifies the current list; a fixed advance-notice period is not promised at this stage.