Subprocessor List
Last updated: August 8, 2026
Scope
Depending on the Goshen service, plan, feature, and customer configuration, the following providers may process limited personal data or customer content to deliver infrastructure, security, authentication, AI, communications, billing, forms, or analytics. Not every provider processes every customer’s data.
Vercel
Purpose: goOS application hosting, delivery, security, and operational analytics. Typical data: requests, account-session traffic, technical diagnostics, and application content needed to serve the product. Processing location: United States and provider infrastructure locations.
Supabase
Purpose: goOS authentication, database, storage, session, and security services. Typical data: account identifiers, workspace records, authentication and MFA information, audit data, and authorized customer content. Processing location: customer project region and provider infrastructure locations.
OpenAI
Purpose: AI model processing for enabled goOS features. Typical data: prompts, authorized business context, tool results, and generated outputs required for the requested AI operation. Processing location: United States and provider infrastructure locations, subject to applicable service configuration and terms.
Stripe
Purpose: subscription checkout, payment processing, invoices, taxes when enabled, fraud prevention, and customer billing portal. Typical data: billing contact, address, plan, payment method, invoice, tax, and transaction information. Goshen generally receives limited status information rather than full card numbers.
Resend
Purpose: transactional and operational email for access, account, support, and billing workflows. Typical data: recipient email, message content, delivery events, and related technical information.
Netlify
Purpose: hosting, delivery, security, and form collection for goshenconsultingllc.com. Typical data: website requests, technical information, and information submitted through Goshen website forms.
Google Analytics
Purpose: optional analytics for goshenconsultingllc.com after consent. Typical data: page and event activity, referral, browser, device, approximate geography, and technical identifiers. Advertising storage, ad personalization, and ad user data are disabled in the Goshen marketing-site implementation.
Customer-directed integrations
A customer may connect third-party email, calendar, CRM, communications, finance, storage, or other providers. Those providers are selected and authorized by the customer and may act as the customer’s processor rather than Goshen’s subprocessor. Their own terms and privacy notices apply.
Changes and questions
Providers may change as services, security, availability, and customer needs evolve. Material changes will be posted here or communicated as required by an applicable agreement. Customers with a contractual objection right should contact privacy@goshenconsultingllc.com.