1. The list
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | EU (Ireland) region |
| Anthropic | Claude API: AI-assisted summaries and category suggestions. Inputs are not used to train Anthropic's models | United States |
| Vercel | Hosts the web application | Edge / United States |
| Sign-in only, if the user chooses Google SSO: email and display name | Only if used | |
| Microsoft | Sign-in only, if the organisation has Microsoft SSO enabled | Only if used |
| Slack | In-app support chat. Message text with name, role and organisation goes to our private support workspace. Observation and evidence data never goes to Slack | United States |
| Resend | Transactional email (invites, notifications, support replies) | United States |
2. Where data lives
Stored service data sits in the European Union (Ireland), covered by the UK’s adequacy regulations. The US providers above see data only to do the job in this table. The detail, including the transfer mechanisms we rely on, is in the privacy policy and the data processing agreement.