| Provider | Purpose | Location | DPA Status | Data Processed |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, PostgreSQL database and object storage | Nuremberg & Falkenstein, Germany (EU) | DPA in place | Everything the platform stores: accounts, AI-system records, evidence files, generated dossiers and backups |
| Mistral AI | Aria — in-product AI assistance: classification, evidence matching, risk drafting | Paris, France (EU) | DPA in place | The compliance content you submit to Aria and the related system metadata. Contractually excluded from model training. |
| Upstash | Rate limiting and short-lived cache | AWS eu-central-1 — Frankfurt, Germany (EU) | Vendor DPA + SCCs | Hashed request identifiers used as rate-limit counters. No compliance content and no message bodies. |
| Sentry (Functional Software, Inc.) | Application error and performance monitoring | Sentry EU region — Germany (EU) | Vendor DPA + SCCs | Error and trace payloads, including IP address and the signed-in user's identifier — performance tracing runs only with your analytics-cookie consent |
| PostHog, Inc. | Product analytics — only with your analytics-cookie consent | PostHog EU Cloud — Frankfurt, Germany (EU) | Vendor DPA + SCCs | Product usage events and identified-user analytics |
| Resend | Transactional email delivery | San Francisco, USA (SCCs) | DPA in place | Recipient name and email address, and the content of notification, verification and sign-in emails |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Dublin, Ireland (EU) · USA (SCCs) | DPA in place | Billing contact and subscription metadata. Card data is submitted to Stripe directly and never reaches Veritome. |
| Google Ireland Ltd. | Google sign-in, Google Analytics (consent-gated) and the Google Drive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) | Vendor DPA + SCCs | The email address in the sign-in assertion; pseudonymous analytics events; for Drive, the file names and links you choose to import — never file contents |
| Microsoft | Microsoft Entra ID sign-in and the SharePoint / OneDrive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) | Vendor DPA + SCCs | The email address in the sign-in assertion; for SharePoint, the file names and links you choose to import — never file contents |
| GitHub | Evidence connector — read-only, only if an admin connects it | USA (SCCs) | Vendor DPA + SCCs | Repository names and links you choose to import as evidence — never repository contents |
| Atlassian (Jira) | Evidence connector — read-only, only if an admin connects it | USA (SCCs) | Vendor DPA + SCCs | Issue keys, summaries and links you choose to import as evidence |
DPA in place means an Article 28 processing agreement has been executed with that provider. Vendor DPA + SCCs means we rely on the provider's own published data processing addendum and standard contractual clauses, which apply through their standard terms of service. Both are lawful bases for processing; we distinguish them so you can see exactly which is which.
Providers we use that are not sub-processors
These process Veritome's own corporate data. They are listed here for completeness because we use them, but they receive no customer data, so they are not sub-processors under Article 28.
Marketing copy in our internal Asset Studio, and rewriting public EU AI Act news from official sources (EUR-Lex, the Commission, the EDPB, national DPAs). No customer compliance data and no personal data reaches it. Both surfaces are admin-only and process public or Veritome-authored material, so Anthropic is a processor of our corporate data rather than a sub-processor of yours. Owner-confirmed 08.07.2026.
Changes to Sub-Processors
Veritome will notify customers at least 30 days in advance of any intended changes to the list of sub-processors, including additions or replacements, giving customers the opportunity to object to such changes.
Notifications of sub-processor changes will be sent via email to the account owner and published on this page. If you have objections to a new sub-processor, please contact us within 30 days of the notification.
If we are unable to resolve your objection, you may terminate the affected services without penalty by providing written notice within the objection period.