Subprocessor List
Subprocessor List
1. Introduction
This list identifies third-party service providers that may process personal data for Veritrellis. The list may be updated from time to time.
2. Current subprocessors and service providers
| Provider | Purpose | Data categories | Location / notes |
|---|---|---|---|
| Hetzner | Hosting and infrastructure | Application data, logs, Customer Content, technical metadata | EU region |
| Self-hosted PostgreSQL | Application database | Account data, workspace data, Customer Content, audit records, permits, logs | Hosted by Veritrellis on EU infrastructure |
| WorkOS | Authentication, identity, SSO/social login support | Account identifiers, email address, login metadata, session/authentication data | May involve international transfers. Transfer mechanism to be confirmed; SCCs in review. |
| Postmark | Transactional email | Email address, email content, delivery metadata | May involve international transfers. Transfer mechanism to be confirmed. |
| Stripe | Billing and payment processing | Billing contact data, subscription data, payment metadata, invoice data | May involve international transfers. Stripe processes under SCCs. |
| HubSpot | CRM and business contact management | Business contact data, sales communications, lead data | May involve international transfers. Transfer mechanism to be confirmed. |
| Self-hosted Directus | CMS / content management | Website/content admin data, content metadata | Hosted by Veritrellis on EU infrastructure |
| PostHog | Web and product analytics (currently active) | Page views, in-app usage events, pseudonymous user identifiers (WorkOS user ID), workspace identifiers, roles, funnel and conversion metadata | US or EU region depending on project configuration. International transfer mechanism under review; SCCs required. |
| Self-hosted Uptime Kuma | Uptime monitoring | Endpoint availability data, limited technical metadata | Hosted by Veritrellis on EU infrastructure |
3. Optional or not-yet-enabled providers
The following providers are not currently enabled for production personal data unless separately configured and disclosed:
| Provider category | Examples | Status |
|---|---|---|
| Error monitoring | Sentry, New Relic, Axiom, Better Stack | Not currently enabled unless later added |
| AI providers | OpenAI, Anthropic, other LLM providers | Not currently connected to Customer Content |
| Support tools | Intercom, Zendesk, Help Scout | Not currently enabled unless later added |
| Marketing pixels | LinkedIn, Google Ads, Meta | Not currently enabled |
| Other analytics | Google Analytics, RudderStack, Amplitude | Not currently enabled; PostHog is the current analytics provider |
4. Note on international transfers
For providers listed above where the transfer mechanism is under review, Veritrellis is in the process of confirming or executing Standard Contractual Clauses (SCCs) or relies on the provider’s existing transfer mechanisms. Where required, transfer impact assessments are being conducted. Until confirmed, we have taken reasonable steps to evaluate and limit the data transferred to these providers.
If you require confirmation of the transfer mechanism for a specific provider before entering into a Data Processing Agreement, contact privacy@veritrellis.ai.
5. Change notifications
Customers may monitor this page for updates. For material changes affecting paid production processing, Veritrellis will use reasonable efforts to notify customers through the application, email, website, or another reasonable channel.