Legal
Subprocessors
Bancroft uses a small set of third-party providers to operate the platform. This page lists every provider that processes personal data on our behalf, what it is used for, and where the processing happens.
Each provider below is bound by contract to process data only as needed to deliver its service to Bancroft, to maintain appropriate security measures, and not to use the data for its own purposes. This list is referenced by the Data Processing Addendum and is the authoritative record of our subprocessors. For how information is handled generally, see the Privacy Policy.
All processing occurs in the United States. Bancroft does not transfer personal data outside the United States in the ordinary course of operating the platform.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Primary application database and encrypted file storage for documents and vault files. | All platform data, including account, household, questionnaire, document, and vault content. | United States (AWS, us-west-2) |
| Vercel | Application hosting, serverless compute, and scheduled jobs. | All data in transit and in process while a request is served. | United States |
| Stripe | Payment processing, subscription billing, and invoicing. | Billing contact details and payment information. Card numbers are collected directly by Stripe and are never stored on Bancroft systems. | United States |
| Resend | Transactional and notification email delivery. | Recipient name and email address, and the content of the message sent. | United States |
| Anthropic | Optional in-product AI assistance for the guided questionnaire. | Only the questionnaire content submitted to the assistant, and only when an optional AI help feature is used. Contractually prohibited from training on the content and not retained by the provider for its own purposes. | United States |
| Sentry | Application error monitoring and session diagnostics. | Diagnostic and technical data, including a masked reconstruction of the affected browser session. Configured to mask text input and form values so typed personal and financial information is not captured. | United States |
| Upstash | Ephemeral key-value store for rate limiting, session revocation, and caching. | Session and request identifiers and short-lived cached values. No questionnaire or document content. | United States |
| Optional single sign-on and address autocomplete during intake. | Account identity details when a user chooses Google sign-in, and partial address text when address autocomplete is used. | United States | |
| Microsoft | Optional single sign-on. | Account identity details when a user chooses Microsoft sign-in. | United States |
| Wealthbox | Optional one-way CRM synchronization, enabled by the Advisor Firm. | Household contact details, and only for firms that connect the integration. | United States |
Changes to this list
Bancroft will update this page before a new subprocessor begins processing personal data. Advisor Firms with an executed Data Processing Addendum may request notice of additions by emailing support@usebancroft.com with the subject line "Subprocessor notice," and may object to a new subprocessor as described in the Addendum.
Last updated: August 11, 2026
Questions about a provider on this list? Contact support@usebancroft.com