Security

Data residency

All customer data is stored in the European Union, on Supabase in the EU region.

Customer data — guests, reservations, vouchers, attachments — is stored in the European Union on Supabase in the EU region. Backups are kept in the same region.

Processing

Application servers run inside the EU. Background jobs that produce exports or send transactional email run in the same region.

Subprocessors

We use a small set of subprocessors, each with their own data-residency posture. The full list is published in the data processing agreement (DPA) and updated whenever it changes:

Supabase — primary database (Postgres + RLS), storage, auth. Hosted in the EU.
Stripe — billing for the Onboard subscription and Stripe Checkout for voucher sales. PII transferred under SCCs.
Resend — transactional email and newsletter dispatch. Email addresses transferred under SCCs.
Anthropic — Claude powers the AI assistant. PII redacted before transmission; zero-retention API mode enabled.
OpenAI — Whisper voice transcription (optional; only when an API key is configured).
Cloudflare — Turnstile bot-defence on public forms.
Vercel — application hosting; EU regions.

Need a copy of the DPA?

Reach out via the contact page and we will send the latest version.

Honest scope note

Onboard has no SMS provider (Twilio, MessageBird etc.) and no SendGrid integration — transactional email goes through Resend. Earlier versions of this page listed both; that was inaccurate.