Colophon · Subprocessors
The hands that touch the desk.
We use a small set of trusted vendors to run the platform. Each is named below with what it does, what it sees, and where it sits. New subprocessors are added to this list before they are wired in — never after.
Application hosting, edge runtime, build pipeline.
Every page request transits Vercel's edge. No content is stored beyond the cache window stated in the privacy policy.
Region — Global edge · primary US/EUPrimary application database (Postgres, serverless).
Member records, encrypted access tokens, applications, campaigns, support tickets, withdrawal requests.
Region — AWS · ap-southeast-1 (Singapore, primary), backups in same regionTransactional email delivery.
Recipient email address and the body of welcomes, application updates, and password-reset notices we send.
Region — USFile storage for support-ticket attachments.
Files a member voluntarily attaches when filing a support ticket.
Region — AWS · multi-region via VercelPayouts to creator bank accounts (when enabled).
Name, government ID, banking detail you submit through Stripe's own onboarding. Nexus Club never sees the bank account number itself.
Region — Global · processed per Stripe Connect termsOAuth authentication for Gmail send (creator-side, optional).
OAuth tokens with the gmail.send scope. We cannot read the inbox, drafts, or sent folder.
Region — Global · per Google Cloud termsInstagram Graph API authorization for campaign publishing (creator-side, opt-in per campaign).
OAuth tokens scoped to instagram_business_basic, instagram_business_manage_comments, instagram_business_content_publish — for the campaign window only.
Region — Global · per Meta platform terms
Material additions to this list are dated above. If you are a brand on a Data Processing Addendum and wish to be notified before a new subprocessor is engaged, write to dpa@thenexusclub.org and we will add you to the list.