Architecture and data flow overview

The service in one paragraph

Etropo is a web application at app.etropo.com. The browser talks to serverless functions on Vercel in Frankfurt, which read and write a PostgreSQL database on Supabase in Frankfurt. There are no servers that Etropo manages. Customers can connect advertising, spreadsheet, CRM and chat services; those connections are made by the customer with OAuth and can be revoked by the customer at any time.

Components

Component	Provider and region	Holds
Web application and API	Vercel, functions in fra1 (Frankfurt), static assets on the global edge	Nothing persistent; secrets in environment variables
Database	Supabase on AWS eu-central-1 (Frankfurt), PostgreSQL 17	All customer data, with Row Level Security on every table
Authentication	Supabase Auth, same region	Password hashes, sessions, two-factor enrolments
File storage	Supabase Storage, same region	Avatars, uploaded invoices
Rate limiting and chat state	Upstash Redis	Counters keyed by user or IP; short-lived state for the Slack and Teams assistants
AI models	Anthropic via Vercel AI Gateway (USA); OpenAI (USA); Mistral AI (EU)	Requests only; nothing stored by Etropo there
Email	Resend (USA)	Transactional email; inbound invoice email
Payments	Stripe (USA)	Billing and card data (card data never reaches Etropo)
Monitoring	Sentry (EU)	Errors, traces, sampled session replays
Analytics	Segment and Mixpanel (USA)	Product events and session replays
Support	Intercom (USA); Linear (USA) for bug reports	Conversations, bug reports
Source and CI	GitHub (USA)	Source code; no customer data

How a request is protected

The browser connects over TLS; HSTS forbids plain HTTP.
The proxy validates the session token locally and, for users with two-factor enabled, requires a second-factor session.
The API route checks the user's organisation membership and role and validates the request body.
The database applies Row Level Security: the row's organisation must match a membership of the caller, and category restrictions apply.
Every response carries a Content Security Policy and the standard security headers.

Data flows that leave the EU

Data leaves Frankfurt only for the purposes below, and only the data named:

Payments: billing contact and subscription details to Stripe.
Email: recipient address and message content to Resend.
AI: the user's question and the budget data that user may see, to Anthropic through the Vercel AI Gateway, when the user asks; an uploaded spreadsheet to OpenAI when the user imports it (deleted from OpenAI after analysis); an uploaded PDF to Mistral AI (EU) for text extraction; for organisations with Budget Buddy enabled, line-item names daily and Marketing Brain entries weekly from two scheduled jobs. Every AI call is traced to Braintrust (USA). The "AI in Etropo" paper, available on request, has the details.
Monitoring and analytics: error reports and product events with user identifiers to Sentry (EU), Segment and Mixpanel; AI call traces to Braintrust.
Support: conversations to Intercom; bug reports to Linear.
Customer-connected integrations: ad spend from, and budget rows to, the services the customer connects.

The Subprocessors page lists each vendor with the exact data and region.

Scheduled jobs

Vercel Cron runs the integration syncs (Google Ads, LinkedIn, Meta, TikTok, Google Sheets, Notion), reminder notifications and trial lifecycle jobs daily, and the Marketing Brain jobs daily and weekly. Each job authenticates with a secret, runs with the service role restricted to one organisation at a time, and writes a log row per run.

Environments

Development on developers' machines against their own test organisation; preview deployments per branch behind a Vercel team login; one production environment. Secrets differ between preview and production.

Version 1.0, October 2026.