Who we trust with your data.
These are the vetted third parties that process personal data on Veltheon's behalf. We keep the list short, name each one, and tell you exactly what it does and where.
v1.0Effective September 9, 2026Revision history ↓
| Sub-processor | Purpose | Data it touches | Region | DPA status | Terms |
|---|---|---|---|---|---|
| Supabase | Managed Postgres database + authentication (identity, sessions) | Names, emails, company, optional contact number and preferred contact time, message text, auth identifiers, approval status, access logs, beta requests, NDA records | Canada (ca-central-1) | DPA available | DPA ↗ |
| Vercel | Application hosting + content delivery | HTTP request metadata, IP addresses, form data in transit | Functions: Canada (yul1, Montréal) · edge network: global | DPA available | DPA ↗ |
| Cloudflare | Edge network, DNS, and access gating | IP addresses, request metadata, access-gate identity (email) | Global edge | DPA available | DPA ↗ |
| Resend | Transactional email delivery | Recipient name + email, email content | US (EU option available) | DPA available | DPA ↗ |
| Microsoft (Microsoft 365 · Bookings) | The [email protected] mailbox, and — once a booking calendar is published — Microsoft Bookings for scheduling the free 30-minute discovery call | Email you send to [email protected] and its contents. If a booking calendar is published, also the name, email and any note you enter ON MICROSOFT'S booking page, plus the meeting time, in order to place the meeting in both calendars. Veltheon's site links out to that page and embeds nothing: no Microsoft code runs on veltheon.ca. While no booking calendar is published, this second flow does not exist | Canada (Microsoft 365 tenant, Canadian data residency) | DPA available | DPA ↗ |
| Microsoft Clarity (optional analytics) | Consent-gated heatmaps and session playback for the public marketing and blog experience only | Pseudonymous interaction, device, page-layout and performance data after the visitor allows analytics. Form inputs are masked; Veltheon configures Strict masking and does not load Clarity on admin, portal, sign-in, or product-delivery routes | Global processing (Microsoft) | DPA available | DPA ↗ |
| Google (Gemini API) | LLM API — embeddings + generation for the compliance / RAG features (not yet live) | Only the content a feature sends in a prompt — personal data minimized. The feature is not yet active: no data has been sent to date | US | DPA available | DPA ↗ |
| GitHub | Source-code hosting + version control for the platform | Source code and commit metadata (developer names + emails) — no customer personal data | US (global) | DPA available | DPA ↗ |
How we manage this list
We give customers prior notice before adding a new sub-processor, with a chance to object. Several of these providers process outside Canada; before we onboard a customer whose data would cross the border — in particular the personal data of a Québec resident — we complete a cross-border transfer assessment (Law 25 s. 17) and minimize what is sent. The LLM-backed features are not yet live — no data has been sent to a model provider to date. When they activate, data sent to the LLM API is kept to the minimum necessary and de-identified where possible, and is sent only on the paid, no-training tier — used solely for our compliance / retrieval features, never carrying customer engagement PII.
The DPA status column reflects how each provider is covered: DPA available means the provider offers a standard Data Processing Addendum we can execute under our account, DPA in place means we have accepted it, and Standard terms means the provider is covered by its terms of service with no separate DPA. Where acceptance is still being confirmed, we show the more conservative “DPA available.”
Want to be notified when this list changes? Email [email protected] and we’ll add you. For the full picture of how we handle data, see our Privacy Policy and Trust & Security page.
Revision history
- v1.0
Initial publication — the first public version of this document, effective for Veltheon's September 9, 2026 public launch. There is no earlier public version.
This is the only version of the Sub-processor Register that has ever been published — it has not been revised since it took effect. We post material changes here with a new version and a new effective date. To be notified when this document changes, email [email protected].
Questions about a provider?
Our Privacy Officer is glad to walk procurement or security teams through any sub-processor in detail.
Request a conversation