Legal & Trust

Vendor Register

Third-party providers used to deliver Klugliv.

⚠️ Requires legal review before production release.

This vendor register is for transparency and may be updated as we add or change processors.

Last updated: 2026-07-20

This register lists key third-party providers used to deliver Klugliv’s services.

For operational subprocessors and AWS/Supabase configuration details, see:

Vendors we use

Vendor	What they do for Klugliv	Data processed (examples)	Region / location (best-effort)	Security considerations
Amazon Web Services (AWS)	Hosts infrastructure (API Gateway, Lambda, S3, KMS, CloudWatch, IAM, budgets, and other managed services).	Receipt images and OCR requests, derived OCR data, operational logs, encrypted secrets.	AWS resources are configured for `eu-central-1` in this repository.	Access is controlled via least-privilege IAM; encryption at rest (for example S3 + KMS).
Supabase	Authentication and core data storage (Postgres + object storage) for the current system slice.	Account identifiers, receipt records, extracted fields, and shopping history in your account.	Depends on your Supabase project configuration.	Uses row-level security in the database and private storage buckets.
Google Cloud Vision	OCR provider for receipt text extraction.	Receipt images (or OCR inputs) and OCR text outputs.	OCR processing can involve cross-border transfers.	API access is restricted via secrets in Secrets Manager; the OCR pipeline requires user authorization for API access.
PostHog	Analytics provider used by the mobile app when an analytics key is configured.	Usage events and feature interactions (not raw receipt images by default).	Depends on the PostHog host configuration used by the app build.	Analytics key is configured per build; we do not embed secret credentials in the app beyond what is required for event collection.

We update this register when we: