Database
Neon, Inc.
- Purpose
- Serverless PostgreSQL database used to store account, session, user-created workspace, and legacy pre-launch enrollment records.
- Location
- United States
- Privacy / DPA
- Neon Privacy
Subprocessors
Last updated: September 16, 2026
This list reflects services confirmed for the public site and live web application, plus explicit notes for provider categories that are not active.
Transactional Email
Resend, Inc.
- Purpose
- Email delivery for account messages, password resets, and opted-in product updates.
- Location
- United States
- Privacy / DPA
- Resend Privacy
Rate Limiting
Upstash, Inc.
- Purpose
- Short-lived, hashed identifiers used to prevent automated abuse of public and administrator actions. Provider analytics are disabled.
- Location
- Configured service region; provider based in the United States
- Privacy / DPA
- Upstash Privacy
Administrator Identity
Clerk, Inc.
- Purpose
- Authentication for the restricted EXPOZOR administrator control plane. Customer workspace accounts do not use Clerk.
- Location
- United States
- Privacy / DPA
- Clerk Privacy
Hosting / CDN
Vercel Inc.
- Purpose
- Hosting, CDN, and deployment infrastructure for the public site and web application.
- Location
- United States
- Privacy / DPA
- Vercel Privacy
AI / OCR
Not enabled
- Purpose
- When optional receipt and voice capture is enabled, submitted images and recordings are processed to extract, transcribe and categorize expense details.
Source content is sent only when you use the capture feature. Retention follows the configured provider account.
- Location
- Not applicable while disabled
- Privacy / DPA
- OpenAI data controls
Capture file storage
Not enabled
- Purpose
- Private storage for uploaded receipt images and temporary audio files, with authenticated access and asynchronous deletion.
Applies only to optional receipt and voice capture.
- Location
- Not applicable while disabled
- Privacy / DPA
- Not applicable
Analytics
None currently active
- Purpose
- No analytics provider is currently active in the codebase.
This list will be updated before any analytics provider is added.
- Location
- Not applicable
- Privacy / DPA
- Not applicable
Payment Processing
None currently active
- Purpose
- The one-month free trial does not collect payments, and no payment processor is currently active.
A payment processor will be listed before paid billing launches.
- Location
- Not applicable
- Privacy / DPA
- Not applicable
| Category | Provider | Purpose | Location | Privacy / DPA |
|---|---|---|---|---|
| Database | Neon, Inc. | Serverless PostgreSQL database used to store account, session, user-created workspace, and legacy pre-launch enrollment records. | United States | Neon Privacy |
| Transactional Email | Resend, Inc. | Email delivery for account messages, password resets, and opted-in product updates. | United States | Resend Privacy |
| Rate Limiting | Upstash, Inc. | Short-lived, hashed identifiers used to prevent automated abuse of public and administrator actions. Provider analytics are disabled. | Configured service region; provider based in the United States | Upstash Privacy |
| Administrator Identity | Clerk, Inc. | Authentication for the restricted EXPOZOR administrator control plane. Customer workspace accounts do not use Clerk. | United States | Clerk Privacy |
| Hosting / CDN | Vercel Inc. | Hosting, CDN, and deployment infrastructure for the public site and web application. | United States | Vercel Privacy |
| AI / OCR | Not enabled | When optional receipt and voice capture is enabled, submitted images and recordings are processed to extract, transcribe and categorize expense details. Source content is sent only when you use the capture feature. Retention follows the configured provider account. | Not applicable while disabled | OpenAI data controls |
| Capture file storage | Not enabled | Private storage for uploaded receipt images and temporary audio files, with authenticated access and asynchronous deletion. Applies only to optional receipt and voice capture. | Not applicable while disabled | Not applicable |
| Analytics | None currently active | No analytics provider is currently active in the codebase. This list will be updated before any analytics provider is added. | Not applicable | Not applicable |
| Payment Processing | None currently active | The one-month free trial does not collect payments, and no payment processor is currently active. A payment processor will be listed before paid billing launches. | Not applicable | Not applicable |
To ask about this list, contact privacy@expozor.com.
Note: Drizzle ORM is not listed above. It is an open-source ORM library that runs inside EXPOZOR's server process and does not send data to an external service.