Draft — not reviewed by a lawyer
These documents were written in-house from the source code and the database, so the facts in them about how Slate behaves are accurate and checkable. The legal drafting is not. No lawyer prepared, reviewed or approved any part of this page, and it must be reviewed by qualified counsel before Slate relies on it or asks anyone else to.
Every company in the path, and the ones that have never seen anything.
A subprocessor list is only worth reading if it distinguishes what is in use from what is merely wired up. This one does, and it names where each fact came from.
Facts checked 14 August 2026
6 companies · 2 in use · 3 never contacted · 1 configured and refusing
Checked 14 August 2026
Established by reading the code that makes the calls, the project’s full dependency list, and the live database region — not by copying another company’s trust page. There is no admin screen that can add an outbound integration to Slate: a new one means new code, a new key and a new row here.
The list
6 outside companies can touch data in Slate. 2 are in the path on every request. 3 have never been handed a single byte — they are wired up and switched off. 1 is configured and rejects everything we give it, which is its own state and not the same as being switched off.
Supabase
Database, authentication and the API that every screen reads through.
- What it can see · Operator and guest data
- Everything Slate stores: operator accounts, organizations, bookings, customer names, email addresses and phone numbers.
- Operator login records — the IP address and browser of each sign-in, held by the authentication service.
- Where
- United States — AWS us-east-1 (Northern Virginia). Read from the live project on 14 August 2026, not assumed.
- Status today
- Always in the path. There is no part of Slate that works without it.
- Checked against
- Live project metadata (region us-east-1, Postgres 17.6) and src/lib/supabase/.
Vercel
Hosting, the serverless runtime that executes every request, and the scheduled jobs.
- What it can see · Operator and guest data
- Every HTTP request: the IP address it came from, the URL, timing and status.
- Runtime logs, which are our own first-party record when something breaks.
- Where
- Serverless execution in Washington, D.C. (Vercel's iad1) — measured on 14 August 2026 from the x-vercel-id response header of the live deployment, not assumed. Vercel's edge network, which terminates the connection and serves cached static files, is global and is not US-only.
- Status today
- Always in the path. Three scheduled jobs run every five minutes: expiring unpaid holds, running automations, and reconciling subscription quantity. The execution region is Vercel's project default — no regions key is pinned in vercel.json — so it is measured rather than configured, and a change made in Vercel's dashboard would move it without touching this repository.
- Checked against
- vercel.json, src/instrumentation.ts, and the x-vercel-id header returned by /book/[slug] and /support — measured on 14 August 2026 against https://slate-phi-eight.vercel.app (the deployment URL in use that day, before the slate-booking.com domain existed) and re-measured on 15 August 2026 against https://slate-booking.com, which returned iad1 both times.
Stripe
Card payments taken on the operator's own Stripe account, and — separately — Slate's own subscription billing.
- What it can see · Operator and guest data
- On a guest checkout: the amounts, the line-item labels and the guest's email address. Names and phone numbers are not passed.
- Card details are entered on Stripe's own hosted page. Slate never receives or stores a card number.
- Whatever Stripe sends back about a payment, stored as-is, which can include the name and address a guest gave Stripe.
- Where
- United States and Stripe's global infrastructure.
- Status today
- No Stripe keys are configured on this deployment. Zero payments have ever been processed and zero subscriptions exist, so no card payment has ever reached Stripe through Slate.
- Checked against
- src/lib/stripe/, and a count of the payments and subscriptions tables (both zero).
Resend
Outbound email — booking confirmations, cancellation notices, operator alerts, and messages from the support form.
- What it can see · Operator and guest data
- The recipient's address, the subject and the body of any message that reaches it.
- Where
- United States.
- Status today
- A key is configured and it is invalid: the provider answers HTTP 400 “API key is invalid” to every request. Resend has never accepted a single message from this deployment, and the message log has never held a delivered row. Slate's email is not working, and this page is not going to pretend otherwise.
- Checked against
- src/lib/email/resendClient.ts, a live probe of the provider API, and a count of the message log — which holds failed rows and has never held a delivered one.
Twilio
Text messages, when an operator turns on an SMS automation.
- What it can see · Guest data
- A phone number and the text of the message.
- Where
- United States and Twilio's global infrastructure.
- Status today
- No Twilio credentials are configured, and SMS is switched off by default for every organization regardless. Nothing has ever been handed to Twilio.
- Checked against
- src/lib/sms/, the org messaging settings table (zero rows), and the message log (which holds no SMS row at all).
Reading an operator's Google Calendar so their existing commitments block out booking slots. Separately, Google sign-in for operator accounts.
- What it can see · Operator data
- The calendar being read, and the sign-in handshake. Busy-block titles come back into Slate.
- Nothing is written back. The permission Slate requests is read-only, so there is no code path that could create or change a Google event even if one were written.
- Where
- Google's global infrastructure.
- Status today
- No operator has connected a calendar — zero connections exist — and the Google sign-in provider is not switched on.
- Checked against
- src/lib/calendar/ (the requested scope is calendar.readonly) and the calendar connections table (zero rows).
And where a company would normally be, and is not
Not counted above, because there is nobody to count. It is on this page because the absence is the useful fact.
None — error monitoring is self-hosted
Recording server errors so they can be fixed.
- What it can see · Infrastructure
- A scrubbed error line: the route template with any identifier removed, and a message with email addresses, references, tokens, keys, card-length digit runs and phone numbers replaced before it is written.
- Where
- Nowhere external.
- Status today
- There is no error-monitoring vendor. No Sentry, no Datadog, no session replay. The destination for error reports is unset in production, so nothing is transmitted anywhere; one scrubbed line goes to our own server logs.
- Checked against
- src/instrumentation.ts and the runtime dependency list.
What is not on the list, and never has been
The absence of a vendor is a stronger statement than the presence of one, and it costs us nothing to make, because there is no code in Slate that could do any of this.
Analytics
No Google Analytics, no tag manager, no PostHog, Segment, Mixpanel, Amplitude, Plausible or Fathom. Not even Vercel's own analytics or speed insights.
Advertising and tracking pixels
No ad network, no conversion pixel, no remarketing tag. Nothing about a visitor is shared with an advertiser, because nothing collects it.
Session replay and heatmaps
No Hotjar, no LogRocket, no Clarity, no recording of what a visitor does on a page.
Customer messaging widgets
No Intercom, no chat bubble, no CRM script. The support page is a plain form and an email address.
CDNs and font hosts
The three brand typefaces are served from Slate's own domain. A guest opening a booking page makes no request to any third party — that was a deliberate decision about the page that takes the money.
Which is also why there is no cookie banner on a Slate booking page: there is no non-essential cookie to ask you about. The Privacy Policy covers that in full.
How that was checked
So you do not have to take our word for the section above. 4 independent checks, each of which someone else could repeat:
- 01A case-insensitive search of the whole source tree for every common analytics, advertising and monitoring library. It returned four matches, all of them English prose in comments explaining why one was rejected. No executable tracker code exists.
- 02The runtime dependency list, read in full: six packages — the Supabase client and its server helper, a date library, and React with Next.js. No analytics SDK of any kind.
- 03The page's own markup: every script it runs and every asset it preloads points at Slate's own origin, including the ones the framework adds for itself. The only inline script we wrote reads the light/dark preference before the first paint. No external stylesheet, no remote font, no remote image, no beacon.
- 04Every outbound URL literal in the source, listed: Stripe, Resend, Twilio and Google, all of them called from the server and all of them key-gated. Nothing in the browser talks to a third party.
When this list changes
A new subprocessor means a code change, so this page is updated in the same work as the integration, and the check date at the top moves with it.
There is no notification list. Slate’s email provider rejects every request, so we cannot honestly point you at an announcement channel — the date on this page is the record. If your business needs advance warning before a new processor is added, write to us and we will agree something in writing that we can actually keep.