Trust Center

Subprocessors

Competency Labs uses a small set of third-party subprocessors to host, secure, and deliver the platform. Each subprocessor is bound by contract to process data only on our instructions and to maintain appropriate security and confidentiality controls.

Last updated July 2026

Current subprocessors

Subprocessor	Function	Data processed	Location / notes
Supabase	Backend database, authentication, and object storage	Account profiles, assessment responses, scoring data, credentials, verification records, and operational logs.	TLS 1.2+ in transit; AES-256 encryption at rest. SOC 2 Type II and ISO 27001 certified. Data hosted in managed cloud regions.
Cloudflare	Edge hosting, CDN, Web Application Firewall, and bot management	Web traffic, cached content, challenge tokens for bot protection, and TLS termination metadata.	Cloudflare Turnstile is used on public forms to distinguish humans from automated traffic. No persistent PII is retained by Turnstile.
Resend	Transactional email delivery	Email addresses, message content, and delivery metadata (opens, clicks, bounces) for operational and notification emails.	Used for waitlist confirmations, beta invitations, account notifications, and security alerts.
Google Fonts	Font stylesheet and web-font delivery	Browser IP addresses and user-agent strings are processed by Google’s CDN when fonts are loaded.	No personal data is intentionally sent to Google Fonts. Fonts are loaded via a single shared stylesheet in the application head.

We do not use subprocessors for behavioural advertising or for selling personal data. We do not intentionally share assessment responses with any subprocessor except as required to store, transmit, or secure the platform.

Change notification

We review our subprocessor list regularly and will notify registered users of any material changes before they take effect. If you need the current list for your own records or vendor due diligence, you can download it from this page at any time.

For questions about a specific subprocessor, or to request a countersigned Data Processing Agreement, email support@competencylabs.com.

Due diligence

Before onboarding a new subprocessor, we review its security certifications, data-handling terms, and subprocessors policy. All subprocessors sign or are bound by standard data-processing terms that prohibit using data for their own purposes, training models on our content, or subcontracting without our prior approval.

Competency Labs does not currently claim SOC 2, ISO 27001, HIPAA, or GDPR certification for its own operations. This page describes the subprocessors we use as design defaults; formal attestations will be published here when completed, with date and scope.