Subprocessors

The third parties that process data on our behalf.

Every third party that processes personal information on Verinode’s behalf is listed here. Required by GDPR Article 28(2) and CCPA service-provider disclosure rules. We update this page whenever the list changes; the date below records the most recent revision.

Last updated: May 2026

Active subprocessors

Infrastructure

Vercel

PurposeApplication hosting, edge and serverless compute.

DataAll operator and user data passing through the application layer.

LocationUnited States, with global edge.

SafeguardsEU-Commission Standard Contractual Clauses (SCCs 2021/914), SOC 2 Type 2, ISO 27001.

Supabase

PurposeManaged Postgres databases (Operator Database + Intelligence Database), storage, and auth.

DataAll operator and user PII.

LocationUnited States; regional deployment (including EU) available on enterprise request.

SafeguardsEU-Commission SCCs (2021/914), SOC 2 Type 2, HIPAA-eligible plans.

Cloudflare

PurposeEmail Routing, CDN, Workers, DNS.

DataInbound email payloads (briefly, before they reach Vercel).

LocationGlobal edge.

SafeguardsEU-Commission SCCs, SOC 2 Type 2, ISO 27001.

LLM providers

Anthropic (Claude API)

PurposeDocument extraction, chain extraction, agent reasoning, signal generation.

DataAnonymised document and email content (PII fields like claim numbers, names, addresses replaced with typed placeholders before transmission); operator metadata; LLM prompts and responses.

LocationUnited States.

SafeguardsNo training on our data (Anthropic's default API policy with feedback sharing disabled in console). Standard 30-day abuse-monitoring retention. Data Processing Addendum executed. SOC 2 Type 2. Enterprise Zero-Data-Retention amendment on the roadmap.

OpenAI

PurposeLLM fallback when Claude is unavailable, vector embeddings, text-to-speech for IQ voice mode (reads IQ's typed replies aloud).

DataSame as Anthropic above, plus IQ's assistant text replies submitted to the OpenAI TTS endpoint for audio generation. No operator voice audio passes through OpenAI: voice-mode microphone capture is routed to Deepgram (see Voice section) and discarded after transcription.

LocationUnited States.

SafeguardsNo training on our data (all sharing and training toggles disabled in console). Standard 30-day abuse-monitoring retention. Data Processing Addendum executed. SOC 2 Type 2. Enterprise Zero-Data-Retention amendment on the roadmap.

Voice (speech-to-text and text-to-speech)

Deepgram

PurposeReal-time speech-to-text for IQ voice mode (operator microphone capture → transcript) and batch transcription for forwarded voice memos and video soundtracks.

DataOperator voice audio captured during voice-mode interactions or attached as audio / video uploads. Audio is streamed to Deepgram, transcribed in-flight, and discarded by Deepgram immediately after transcription under the zero-retention flag set on every request. Only the resulting transcript is returned to Verinode and stored against the operator's chat log or ingestion record.

LocationUnited States.

SafeguardsZero-retention mode enabled per request (Deepgram's documented "no audio stored, no transcript stored" posture). No training on customer audio under Deepgram's standard customer terms. SOC 2 Type 2. HIPAA-eligible plan with BAA available on request. Data Processing Addendum executed.

Identity and access

WorkOS

PurposeEnterprise SSO (SAML 2.0, OIDC) and SCIM 2.0 directory-sync provisioning.

DataUser name, email address, group / role assignments, IdP-specific metadata (organization ID, connection ID). No operator business data.

LocationUnited States.

SafeguardsEU-Commission SCCs, SOC 2 Type 2, signed DPA.

Operations

Resend

PurposeTransactional email (welcome, invites, password reset, signal digests).

DataUser name, email address, message subject and body.

LocationUnited States.

SafeguardsEU-Commission SCCs, SOC 2 Type 2.

Twilio

PurposeSMS notifications and survey delivery.

DataRecipient phone number, message body.

LocationUnited States.

SafeguardsEU-Commission SCCs, SOC 2 Type 2, HIPAA BAA available on request.

Stripe

PurposeSubscription billing and payment processing.

DataOperator name, billing email, billing address, payment method (card stored at Stripe, not at Verinode).

LocationUnited States and global processing nodes.

SafeguardsPCI-DSS Level 1, SOC 2 Type 2, EU-Commission SCCs.

Better Stack

PurposeExternal WORM audit-log retention via Vercel Log Drain. Provides immutability outside Verinode's blast radius.

DataAudit metadata only (event kind, table, action, user_id, operator_id, outcome, structured detail). Filter keys are streamed; filter values are not. No raw operator business data.

LocationUnited States.

SafeguardsSCCs where applicable, SOC 2 Type 2 (Better Stack Telemetry product).

Apify

PurposeWeb scraping for vendor, regulatory, and market intelligence (no operator PII; only public web content).

DataNone: public-source intelligence only.

LocationUnited States and EU.

SafeguardsSCCs where applicable (no operator PII processed).

Internal observability

Vercel Analytics + Logs

PurposePerformance monitoring, error tracking.

DataAnonymised request paths, response times, error stack traces. No operator PII in payloads.

LocationUnited States.

SafeguardsSame as Vercel hosting.

What subprocessors we do not use

For clarity (questions come up):

  • ·Carrier-aligned analytics providers (Verisk, Cotality, and similar): never used as a sub-processor and never given operator data. This is a binding commitment in the Data Use Policy.
  • ·Advertising networks and data brokers: none, ever.
  • ·Operator-data sale or licensing arrangements: none, ever.

How we evaluate subprocessors

Before adding a sub-processor, we verify:

  1. 1.They have a published security posture (SOC 2 Type 2 or ISO 27001 ideally; demonstrably substantive security otherwise).
  2. 2.They will sign a Data Processing Agreement (DPA) consistent with our obligations to operators.
  3. 3.For non-US operators: they offer EU-Commission Standard Contractual Clauses or equivalent transfer mechanism.
  4. 4.For LLM providers: zero-retention or no-training-on-our-data is contractually guaranteed.
  5. 5.We can audit their processing on request (right-to-audit clause in DPA).

Notification of changes

We keep this page current and email operators when the subprocessor list changes. If a change affects how your data is processed and you object, you can exercise your erasure right at any time under our normal data-subject-request procedure.

Contact

Questions, objections, or DPA requests: [email protected].

This is a living document. Subprocessor changes take effect on the revision date above.