Trust Center

Subprocessors

Competency Labs uses a small set of third-party subprocessors to host, secure, and deliver the platform. Each subprocessor is bound by contract to process data only on our instructions and to maintain appropriate security and confidentiality controls.

Last updated July 2026

Current subprocessors

Subprocessor	Function	Data processed	Location / notes
Lovable Cloud (Supabase)	Hosting, backend database, authentication and file storage	Account profiles, assessment responses, scoring data, credentials, verification records and operational logs.	Encrypted in transit and at rest by the provider.
Cloudflare	Edge hosting and content delivery	Web traffic and request metadata.	Serves the site and its server functions.
Stripe	Payments and subscriptions	Billing name, email, payment method details held by Stripe, and transaction records.	Card details are handled by Stripe and are not stored by BORAKA.
Brevo and Resend	Email delivery	Email addresses, message content and delivery events such as bounces.	Used for account, assessment, guide and notification emails. Unsubscribes and bounces are honoured.
Circle	BORAKA Network community	Name and email of members invited to the community.	Used only when someone is invited to the community, for example after a Pro purchase.
Google Analytics and Tag Manager	Site usage analytics	Pseudonymous usage events, browser and device data.	Subject to the cookie policy.
AI model providers via the Lovable AI Gateway	Drafting assistance for feedback	Text of submitted work products when AI-assisted feedback is used.	AI never issues a credential. Verified results require human review.

We do not use subprocessors for behavioural advertising or for selling personal data. We do not intentionally share assessment responses with any subprocessor except as required to store, transmit, or secure the platform.

Change notification

We review our subprocessor list regularly and will notify registered users of any material changes before they take effect. If you need the current list for your own records or vendor due diligence, you can download it from this page at any time.

For questions about a specific subprocessor, or to request a countersigned Data Processing Agreement, email support@boraka.co.

Due diligence

Before onboarding a new subprocessor, we review its security certifications, data-handling terms, and subprocessors policy. All subprocessors sign or are bound by standard data-processing terms that prohibit using data for their own purposes, training models on our content, or subcontracting without our prior approval.

Competency Labs does not currently claim SOC 2, ISO 27001, HIPAA, or GDPR certification for its own operations. This page describes the subprocessors we use as design defaults; formal attestations will be published here when completed, with date and scope.