Servers in Germany, GDPR-compliant, DPA included — and Row-Level Security on every database table that belongs to a restaurant.
Onboard handles sensitive data: guest contacts, employee documents, reservations. We treat it that way. The four pillars below describe how.
The data processing agreement (DPA) is ready to download and doesn’t need to be negotiated separately. Sub-processors are listed below in detail — name, purpose, region.
DPA available as PDF · sub-processor table listed openly
Every table that belongs to a restaurant has Row-Level Security policies in the database. That means: even at the database layer no account can read data from another restaurant — not by accident, not through an app bug.
Migration 0002_rls.sql plus follow-up policies in subsequent migrations
The app and database run in the EU. We use Supabase with the Frankfurt region for the primary database.
Region: EU (Frankfurt) — see sub-processors below
Accounts have three roles: owner, manager, employee. Permissions are enforced via JWT claims and database policies. External agents (ChatGPT, Claude.ai) get separate OAuth 2.1 tokens you can revoke any time.
JWT claim migrations 0025, 0027 · OAuth migration 0072_oauth_clients.sql
We name every service that processes personal data for the operation of Onboard — with purpose and region.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, Auth, Storage | EU (Frankfurt) |
| Vercel | Hosting of the web app | EU (Frankfurt) · Edge global |
| Stripe | Billing and voucher sales | Ireland (EU) · USA |
| Resend | Transactional email | EU · USA |
| Anthropic | AI Assistant (Claude) | USA · EU endpoint available |
| OpenAI | Voice input (Whisper) — optional | USA |
| Vapi | Phone assistant — voice AI for inbound calls | USA |
| Twilio | Phone numbers and call routing for the phone assistant | USA · EU |
| Cloudflare | Turnstile, DDoS protection | Global |
| Reserve with Google | EU · USA | |
| Google Firebase (FCM) | Push notifications to the staff app (Android and iOS) | EU · USA |
| Apple (APNs) | Push notifications to the iOS staff app | USA |
| Expo / EAS | Build and delivery of the mobile staff app (iOS and Android) | USA |
We send you the Data Processing Agreement (DPA / "AV") as a signed template by email on request — drop us a line and we usually answer the same business day.
Write to us — we answer in under 24 hours on business days.