Subprocessors
Last updated: 7 October 2026
This list describes third parties that may process personal data or customer contract content on behalf of Venedon when you use the service. Your organisation's Master DPA governs subprocessors and change notification. Internal register: compliance/registers/subprocessor-register.md
| Subprocessor | Purpose | Data processed | Region notes |
|---|---|---|---|
| Supabase | Database, authentication, application metadata | User accounts, organisation data, contract metadata, facts, audit events | Hosted in the Supabase project region you configure (typically EU for UK customers). |
| Vercel | Web application hosting | HTTP request metadata; environment configuration | Edge and deployment region per Vercel project settings. |
| Railway | Intelligence API and background workers | Processing requests referencing contract IDs and organisation context | Deployment region per Railway project settings. |
| Amazon Web Services | Object storage, document OCR (Textract), optional KMS | Contract and bid document files; OCR payloads | Default application configuration uses eu-west-2 (London) for S3/Textract. |
| Anthropic | Large language model inference for extraction and advisory features | Contract and clause text in API prompts (ZDR beta headers on contract paths) | United States API; international transfer mechanisms apply under your DPA. |
| OpenAI | Text embeddings for semantic search | Clause text submitted for embedding when embeddings are enabled | United States API; international transfer mechanisms apply under your DPA. |
| Upstash | Redis queue and rate limiting | Job metadata and counters (not full contract bodies by default) | Region per Upstash database configuration. |
| Stripe | Subscription billing (when enabled) | Billing contact and payment metadata | Stripe global infrastructure; see Stripe DPA. |
| Cloudflare | Turnstile bot protection on auth flows (when enabled) | Challenge tokens and related IP metadata | Cloudflare global network. |
| Sentry | Error monitoring (when enabled) | Stack traces and diagnostic events (default PII collection disabled in SDK config) | Region per Sentry project. |
Optional integrations (customer-enabled)
These apply only when your organisation connects an integration.
| Subprocessor | Purpose | Data processed | Region notes |
|---|---|---|---|
| Microsoft 365 / Google / Box | Customer repository synchronisation (optional) | OAuth tokens and file metadata/content from customer-controlled tenants | Customer tenant region. |
| Salesforce | CRM integration (optional) | Deal metadata synchronised with customer Salesforce org | Customer Salesforce region. |