Subprocessors
Effective October 5, 2026/Approved by Evan Singer
What a subprocessor is here
A subprocessor is a third party that can hold or handle data on our behalf while we deliver the service to you. Everything that can touch tenant data is on this page.
A software library that runs inside our own systems is not a subprocessor and is not listed — nothing leaves our infrastructure for it. The distinction is the point of the page: this is the list of places your data actually goes.
Always used
These are part of running the platform. Every tenant uses them.
| Subprocessor | What it does | What it can see | Region |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Request metadata and any data in transit through the application | United States |
| Supabase | Managed Postgres database and authentication | All tenant records, user accounts, and credentials | United States |
| Microsoft Azure Blob Storage | Document and file storage | Uploaded documents, attachments, and generated files | United States |
| Anthropic | Large language model inference for Bromel and in-module AI | Prompt content, which may include tenant business records and, where the mail agent is used, the text of email messages | United States |
| Resend | Transactional email delivery | Recipient address, subject, and message body | United States |
| Sentry | Error monitoring | Stack traces, request context, and the user id associated with an error | United States |
Only if you turn them on
These are integrations a tenant chooses to connect. If you never connect one, no data reaches it.
| Subprocessor | What it does | What it can see | Region |
|---|---|---|---|
| Microsoft Graph | Single sign-on, and mailbox access for the mail agent where a person connects their own mailbox | Directory identity for sign-on. For a connected mailbox: message headers, subjects and text, and attachment names; an attachment's contents only when the person files it; reply drafts saved to their own Drafts folder (never sent) | United States |
| DocuSign | Electronic signature, where a tenant enables it | Documents sent for signature and signer names and addresses | United States |
| Slack | Notification delivery, where a tenant connects a workspace | Notification content sent to the channels the tenant selects | United States |
AI processing, specifically
Anthropic appears in the first table because Bromel and the in-module AI features send prompt content to a model, and that content can include your business records. That is the honest description, and it is the one an auditor should get.
What reaches a model, what never does, and what is not used for training are set out in AI Data Handling.
Where your data is hosted
Vered runs in the United States. The application runs on Vercel in its US West region (Oregon), and the database is a managed Postgres instance on Supabase in AWS us-west-2 (Oregon), the same region, so your records do not cross regions while the product is in use. The region each other subprocessor processes data in is shown in the tables above.
If there is a breach
If we confirm that your data, or personal data we hold for you, was accessed or disclosed by someone not authorised to see it, we will tell your named security or account contact within 72 hours of confirming it. The notice says what happened and when, what data and which users were involved, what we have done, what you should do, and who to contact. Anything not yet known is stated as unknown rather than guessed. Where your agreement with us sets a shorter period, the agreement applies.
Changes to this list
We keep this page current. Customers with a data processing agreement receive notice of a new subprocessor on the terms set in that agreement. To ask a question about any entry, or about a vendor you expected to see and do not, write to legal@vered.io.
Questions about this document go to legal@vered.io.
← All legal notices