Morph

Subprocessors

Last updated: April 12, 2026

Morph ("we", "us", Manikandan G trading as Ironmint) uses the subprocessors listed below to deliver the Service. Each subprocessor is bound by a written data processing agreement with obligations at least as protective as those in our own DPA.

We review this list as changes occur. You can subscribe to updates by emailing support@ironmint.studio with the subject line Subprocessor updates — we will notify you at least 30 days before adding or replacing a subprocessor, as required by our DPA §9.3.

Current subprocessors

| Provider | Service provided | Processing region | DPA | |---|---|---|---| | Supabase, Inc. | Primary database (PostgreSQL), authentication, object storage, edge functions | United States | https://supabase.com/legal/dpa | | Vercel Inc. | Application hosting, serverless functions, cron jobs, logs, edge network | United States (primary), global edge network | https://vercel.com/legal/dpa | | Lemon Squeezy (Affluent, LLC) | Payments, subscription billing, Merchant of Record, tax handling, invoices | United States | https://www.lemonsqueezy.com/dpa | | Resend (Resend, Inc.) | Transactional email delivery (verification, receipts, lifecycle notices) | United States | https://resend.com/legal/dpa |

Details

Supabase — Hosts all structured Customer Data: user accounts, site configurations, rules, aggregate statistics, and logs. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Row-level security is enforced at the database layer to isolate Customer tenants. Supabase is SOC 2 Type II certified.

Vercel — Runs the Morph dashboard and API routes, including the scheduled cron jobs that handle trial/grace/paused lifecycle, daily aggregation, and weekly summaries. Vercel processes request metadata (IP, user agent, response status) as part of standard platform logging, retained for 30 days. Vercel is SOC 2 Type II and ISO 27001 certified.

Lemon Squeezy — Acts as Merchant of Record for Morph subscriptions, meaning Lemon Squeezy is the counterparty to the payment transaction and is responsible for collecting and remitting sales tax, VAT, and GST where applicable. Lemon Squeezy receives the Customer's billing name, billing address, tax ID, and payment method details directly — we never see full card numbers. Morph receives only subscription status, plan, and the last-four digits of the card.

Resend — Sends transactional email on our behalf: sign-up verification, password resets, trial-ending notices, grace-period notices, paused-account notices, and deletion warnings. We pass the recipient email address and email contents to Resend at send time. Resend retains message metadata (sender, recipient, status, timestamps) in line with its own retention policy.

Infrastructure subprocessors (indirect)

Our direct subprocessors themselves use underlying cloud infrastructure. These are not processors of Morph directly but are part of the data processing chain:

| Direct subprocessor | Underlying infrastructure | |---|---| | Supabase | Amazon Web Services (AWS) | | Vercel | Amazon Web Services (AWS), Cloudflare | | Lemon Squeezy | Amazon Web Services (AWS) | | Resend | Amazon Web Services (AWS) |

Previously used

None at the time of writing.

When we replace a subprocessor, we will list the predecessor here for 12 months before removing it, so you have a historical record.

Regions and international transfers

Primary processing takes place in the United States. Where Customer Personal Data is transferred out of the EU/EEA, UK, or Switzerland, the transfer is made under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Addendum. See DPA §10 for details.

How we review subprocessors

Before engaging a new subprocessor we:

  1. Confirm they offer a written DPA that meets the obligations in our own DPA.
  2. Verify their security practices and certifications where available (SOC 2, ISO 27001).
  3. Assess the processing region and any cross-border transfer implications.
  4. Document the purpose and the categories of personal data involved.

Contact

Questions about this list, or objections under DPA §9.3:

Manikandan G, trading as Ironmint Email: support@ironmint.studio Address: Coimbatore, Tamil Nadu, India