Who Mycelium uses to deliver the runtime, where they sit, and what they touch.
Last updated: 2026-05-05
Subprocessors
Subprocessors are the third-party services Mycelium uses to deliver its runtime. Every entry below names what the subprocessor does, what data they process, and where their primary processing region sits. Customer notification on additions: 30 days advance notice via email to the procurement contact named in the engagement letter, with the right to object before the new subprocessor is engaged. Canonical reference is the Mycelium Data Processing Addendum.
Current subprocessor list
| Subprocessor | Purpose | Data processed | Region | DPA |
|---|---|---|---|---|
| Vercel | Application hosting + edge runtime + analytics | Anonymized request metadata (IP, user agent, route, response time) | Global edge; primary US | Link |
| Supabase | Authentication + Postgres-backed runtime data store | Tenant authentication tokens, hashed identifiers, runtime metadata | Customer-selectable: US, EU, AP | Link |
| Anthropic | Default LLM under Claude in every paid customer install (per-tenant opt-out available) | Agent-loop messages routed through the Claude API, scoped to the customer's tenant memory | US | Link |
| PostHog | Product analytics + session replay (anonymized) | Anonymized event metadata, no message content | EU and US (customer-selectable) | Link |
| Resend | Transactional email delivery (pilot inquiry forms, customer notifications) | Email addresses + message content for transactional emails | US | Link |
| Sentry | Application error monitoring | Error stack traces (PII redacted at the SDK layer) | US | Link |
Customer notification policy
Adding a new subprocessor requires 30 days advance written notice to the procurement contact named in your engagement letter. The notice names the subprocessor, the purpose, the data categories processed, and the region. You have the right to object during the notice period. Removal of a subprocessor is communicated within 7 days of removal. If a subprocessor materially fails their security obligations, we notify customers within 24 hours.
Recent changes
- 2026-05-05 · Initial published list
Canonical reference
The Mycelium Data Processing Addendum is the canonical source for the subprocessor list, the data-categories, and the customer notification commitments. This page surfaces the same information at a stable URL so procurement teams can reference it directly without re-reading the DPA.
Mycelium · founded 2026