This page lists the service providers KillDebt uses to deliver its services, including KillDebt for Enterprise. It is referenced by the Data Processing Agreement, the Enterprise Terms, and the Privacy Policy.
For enterprise customers, KillDebt gives at least 10 days’ notice before adding a new subprocessor that processes Customer Personal Data. To receive notifications, email support@killdebt.com with the subject "Subprocessor notifications".
Core infrastructure
| Provider | Function | Certification / posture |
|---|---|---|
| Supabase (on AWS) | Database and file storage; dedicated enterprise database project | SOC 2 Type II |
| Vercel | Application hosting and delivery | SOC 2 Type II; ISO 27001 |
| Stripe | Payment processing (KillDebt never receives card numbers) | PCI DSS Level 1; SOC 2 |
| Resend | Transactional email (account and billing notices) | SOC 2 Type II |
| Upstash | Rate limiting (short-lived request counters only) | SOC 2 Type II |
| Langfuse | Service observability (query logs) | SOC 2 Type II; ISO 27001 |
| ActiveCampaign | Contact records (name, email, account status) for account lifecycle communications | SOC 2 |
AI pipeline
Receives research query content and processes generation.
| Provider | Function | Certification / posture |
|---|---|---|
| AI model providers, routed through the Vercel AI Gateway: OpenAI, Anthropic, Google | Language-model inference | SOC 2 Type II (each); API inputs are not used to train models |
| CourtListener (Free Law Project) | Case-law search and citation verification | Non-profit public legal data service |
| U.S. SEC EDGAR | Public-company and debt-buyer filings | U.S. government public data source |
| Voyage AI | Text embeddings for semantic search | SOC 2 Type II |
Document features
Engaged only when files are uploaded.
| Provider | Function | Certification / posture |
|---|---|---|
| Mistral AI | Document OCR (text extraction from uploaded PDFs and images) | SOC 2 Type II; API inputs are not used to train models |
Notes
CourtListener and U.S. SEC EDGAR are public data sources that receive research query content to execute searches; they do not host customer accounts or store customer data.
All customer data is stored and processed in the United States.