Subprocessors

These are the companies that process customer data so Norma can run. Each gets only what its job needs. We'll update this page, and change its version date, before we add a new one; customers who signed our DPA can ask to be told by email.

Subprocessor	What it does for Norma	Data it handles	Location
Supabase, Inc.	Database, sign-in, and file storage	Everything stored in Norma: accounts, records, files	United States (AWS us-east-2, Ohio)
Vercel Inc.	Hosts the Norma apps and website, and runs scheduled jobs	All data passing between your browser and Norma; request logs	United States (Washington, DC)
Resend, Inc.	Sends Norma's email: invitations, sign-in links and codes, notifications, digests	Recipient name and address, and the email's content	United States
Stripe, Inc.	Payments and subscriptions	Billing contact, company details, payment card details (collected by Stripe directly)	United States
Intuit Inc. (QuickBooks Online)	Only if your organization connects QuickBooks: receives the customers and invoices you send to it	Customer names and invoice lines	United States

Other services Norma contacts

• US International Trade Administration — Consolidated Screening List (data.trade.gov). Used by NormaECS only. When you screen a name, that name is sent to the government's search service. Nothing else about you or your organization is sent. The full list is also downloaded once a day, which sends no data at all.

We don't use any other third-party service that receives customer data: no analytics, advertising, or error-tracking vendors.

Questions: support@normaqms.com.