Sub-processors and data providers
The third parties involved in processing personal data in Tables, and the role each one plays.
Last updated: 18 August 2026 — Theoflow ApS, CVR 45593185
This page lists the third parties involved in processing personal data in Tables (tables.so) and the role each one plays. There are two distinct roles, and some providers appear in both.
1. Sub-processors
These process personal data on our behalf and on our instructions, in respect of the data you process in the platform. This list constitutes the approved list under our Data Processing Agreement.
- Vercel, Inc. (USA): Hosting and operation of the platform's application layer (functions run in the EU and the USA).
- Neon, Inc. (USA): Hosting of the database containing customer data (data stored in the EU, in Frankfurt).
- Trigger.dev: Background job execution — bulk reveals, CSV import, list export, CRM sync and AI enrichment run here.
- Upstash, Inc.: Rate limiting; stores email addresses as short-lived keys.
- Stripe, Inc. (USA): Subscription billing and payment.
- Loops: Transactional and product email to account users.
- Featurebase: In-app feedback and changelog; identifies the signed-in user.
- PostHog, Inc. (USA): Product analytics and usage statistics in the web application (data in the EU, in Frankfurt).
- OpenAI, L.L.C. (USA): AI-based enrichment of the controller's data.
- Anthropic, PBC (USA): AI-based enrichment of the controller's data.
- Contact enrichment providers — see section 2: Look-up and enrichment of contact details (phone, email) on data you upload to the platform.
We give at least 30 days' prior notice before adding or replacing a sub-processor, so you have the opportunity to object. Objections and questions can be sent to privacy@tables.so.
2. Data providers (independent controllers)
These providers play a second and separate role. When a customer searches for new business contacts — as distinct from enriching data they have uploaded — the contact details come from a data provider that collected and compiled that data on its own account.
In that role the provider is an independent data controller, not our sub-processor. Theoflow ApS is likewise an independent data controller for making the data available, rather than the customer's processor. That processing falls outside the Data Processing Agreement — see Clause 3a of the DPA and section 5 of our Privacy Policy.
Our data providers: Prospeo (prospeo.io), Findymail, Coresignal, ContactOut.
If you are an individual whose business contact details appear in the platform: write to privacy@tables.so and we will tell you which provider supplied your information, so you can approach them directly, and we will suppress your details across the platform if you ask.