Legal
Subprocessors
Bancroft uses a small set of third-party providers to operate the platform. This page lists every provider that processes personal data on our behalf, what it is used for, and where the processing happens.
Each provider below is bound by contract to process data only as needed to deliver its service to Bancroft, to maintain appropriate security measures, and not to use the data for its own purposes. This list is referenced by the Data Processing Addendum and is the authoritative record of our subprocessors. For how information is handled generally, see the Privacy Policy.
All processing occurs in the United States. Bancroft does not transfer personal data outside the United States in the ordinary course of operating the platform.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Primary application database and encrypted file storage for documents and vault files. | All platform data, including account, household, questionnaire, document, and vault content. | United States (AWS, us-west-2) |
| Vercel | Application hosting, serverless compute, and scheduled jobs. | All data in transit and in process while a request is served. | United States |
| Stripe | Payment processing, subscription billing, and invoicing. | Billing contact details and payment information. Card numbers are collected directly by Stripe and are never stored on Bancroft systems. | United States |
| Resend | Transactional and notification email delivery. | Recipient name and email address, and the content of the message sent. | United States |
| Anthropic | Optional in-product AI assistance: the questionnaire help feature and the client dashboard plan assistant. | Only what a question needs, and only when an AI feature is used: the questionnaire text for the help feature; for the plan assistant, a summary of the plan with names or totals only when the question asks for them. Under the commercial terms of the provider, the content is not used to train models, and it is deleted within 30 days except where those terms allow longer retention for usage-policy enforcement or legal requirements. | United States |
| Sentry | Application error monitoring and session diagnostics. | Diagnostic and technical data, including a masked reconstruction of the affected browser session. Configured to mask text input and form values so typed personal and financial information is not captured. | United States |
| Upstash | Ephemeral key-value store for rate limiting, session revocation, and caching. | Session and request identifiers and short-lived cached values. No questionnaire or document content. | United States |
| Optional single sign-on and address autocomplete during intake. | Account identity details when a user chooses Google sign-in, and partial address text when address autocomplete is used. | United States | |
| Microsoft | Optional single sign-on. | Account identity details when a user chooses Microsoft sign-in. | United States |
| CSC | Electronic recording of deeds with county recorders, for deed recording orders. | The deed and the information needed to record it: the owners and trustees named on it, the property address, the legal description and the parcel number. | United States |
| Wealthbox | Optional one-way CRM synchronization, enabled by the Advisor Firm. | Household contact details, and only for firms that connect the integration. | United States |
Changes to this list
Bancroft will update this page before a new subprocessor begins processing personal data. Advisor Firms with an executed Data Processing Addendum may request notice of additions by emailing support@usebancroft.com with the subject line "Subprocessor notice," and may object to a new subprocessor as described in the Addendum.
Last updated: October 5, 2026
Questions about a provider on this list? Contact support@usebancroft.com