Subprocessors
The third parties that process data on our behalf.
Every third party that processes personal information on Verinode’s behalf is listed here. Required by GDPR Article 28(2) and CCPA service-provider disclosure rules. We update this page whenever the list changes; the date below records the most recent revision.
Last updated: May 2026
Active subprocessors
Infrastructure
- Vercel
PurposeApplication hosting, edge and serverless compute.
DataAll operator and user data passing through the application layer.
LocationUnited States, with global edge.
SafeguardsEU-Commission Standard Contractual Clauses (SCCs 2021/914), SOC 2 Type 2, ISO 27001.
- Supabase
PurposeManaged Postgres databases (Operator Database + Intelligence Database), storage, and auth.
DataAll operator and user PII.
LocationUnited States; regional deployment (including EU) available on enterprise request.
SafeguardsEU-Commission SCCs (2021/914), SOC 2 Type 2, HIPAA-eligible plans.
- Cloudflare
PurposeEmail Routing, CDN, Workers, DNS.
DataInbound email payloads (briefly, before they reach Vercel).
LocationGlobal edge.
SafeguardsEU-Commission SCCs, SOC 2 Type 2, ISO 27001.
LLM providers
- Anthropic (Claude API)
PurposeDocument extraction, chain extraction, agent reasoning, signal generation.
DataAnonymised document and email content (PII fields like claim numbers, names, addresses replaced with typed placeholders before transmission); operator metadata; LLM prompts and responses.
LocationUnited States.
SafeguardsNo training on our data (Anthropic's default API policy with feedback sharing disabled in console). Standard 30-day abuse-monitoring retention. Data Processing Addendum executed. SOC 2 Type 2. Enterprise Zero-Data-Retention amendment on the roadmap.
- OpenAI
PurposeLLM fallback when Claude is unavailable, vector embeddings, text-to-speech for IQ voice mode (reads IQ's typed replies aloud).
DataSame as Anthropic above, plus IQ's assistant text replies submitted to the OpenAI TTS endpoint for audio generation. No operator voice audio passes through OpenAI: voice-mode microphone capture is routed to Deepgram (see Voice section) and discarded after transcription.
LocationUnited States.
SafeguardsNo training on our data (all sharing and training toggles disabled in console). Standard 30-day abuse-monitoring retention. Data Processing Addendum executed. SOC 2 Type 2. Enterprise Zero-Data-Retention amendment on the roadmap.
Voice (speech-to-text and text-to-speech)
- Deepgram
PurposeReal-time speech-to-text for IQ voice mode (operator microphone capture → transcript) and batch transcription for forwarded voice memos and video soundtracks.
DataOperator voice audio captured during voice-mode interactions or attached as audio / video uploads. Audio is streamed to Deepgram, transcribed in-flight, and discarded by Deepgram immediately after transcription under the zero-retention flag set on every request. Only the resulting transcript is returned to Verinode and stored against the operator's chat log or ingestion record.
LocationUnited States.
SafeguardsZero-retention mode enabled per request (Deepgram's documented "no audio stored, no transcript stored" posture). No training on customer audio under Deepgram's standard customer terms. SOC 2 Type 2. HIPAA-eligible plan with BAA available on request. Data Processing Addendum executed.
Identity and access
- WorkOS
PurposeEnterprise SSO (SAML 2.0, OIDC) and SCIM 2.0 directory-sync provisioning.
DataUser name, email address, group / role assignments, IdP-specific metadata (organization ID, connection ID). No operator business data.
LocationUnited States.
SafeguardsEU-Commission SCCs, SOC 2 Type 2, signed DPA.
Operations
- Resend
PurposeTransactional email (welcome, invites, password reset, signal digests).
DataUser name, email address, message subject and body.
LocationUnited States.
SafeguardsEU-Commission SCCs, SOC 2 Type 2.
- Twilio
PurposeSMS notifications and survey delivery.
DataRecipient phone number, message body.
LocationUnited States.
SafeguardsEU-Commission SCCs, SOC 2 Type 2, HIPAA BAA available on request.
- Stripe
PurposeSubscription billing and payment processing.
DataOperator name, billing email, billing address, payment method (card stored at Stripe, not at Verinode).
LocationUnited States and global processing nodes.
SafeguardsPCI-DSS Level 1, SOC 2 Type 2, EU-Commission SCCs.
- Better Stack
PurposeExternal WORM audit-log retention via Vercel Log Drain. Provides immutability outside Verinode's blast radius.
DataAudit metadata only (event kind, table, action, user_id, operator_id, outcome, structured detail). Filter keys are streamed; filter values are not. No raw operator business data.
LocationUnited States.
SafeguardsSCCs where applicable, SOC 2 Type 2 (Better Stack Telemetry product).
- Apify
PurposeWeb scraping for vendor, regulatory, and market intelligence (no operator PII; only public web content).
DataNone: public-source intelligence only.
LocationUnited States and EU.
SafeguardsSCCs where applicable (no operator PII processed).
Internal observability
- Vercel Analytics + Logs
PurposePerformance monitoring, error tracking.
DataAnonymised request paths, response times, error stack traces. No operator PII in payloads.
LocationUnited States.
SafeguardsSame as Vercel hosting.
What subprocessors we do not use
For clarity (questions come up):
- ·Carrier-aligned analytics providers (Verisk, Cotality, and similar): never used as a sub-processor and never given operator data. This is a binding commitment in the Data Use Policy.
- ·Advertising networks and data brokers: none, ever.
- ·Operator-data sale or licensing arrangements: none, ever.
How we evaluate subprocessors
Before adding a sub-processor, we verify:
- 1.They have a published security posture (SOC 2 Type 2 or ISO 27001 ideally; demonstrably substantive security otherwise).
- 2.They will sign a Data Processing Agreement (DPA) consistent with our obligations to operators.
- 3.For non-US operators: they offer EU-Commission Standard Contractual Clauses or equivalent transfer mechanism.
- 4.For LLM providers: zero-retention or no-training-on-our-data is contractually guaranteed.
- 5.We can audit their processing on request (right-to-audit clause in DPA).
Notification of changes
We keep this page current and email operators when the subprocessor list changes. If a change affects how your data is processed and you object, you can exercise your erasure right at any time under our normal data-subject-request procedure.
Contact
Questions, objections, or DPA requests: [email protected].