Legal
Subprocessors
Last updated: August 2026
This page lists the third-party subprocessors that process personal data on our behalf in providing the Velador service. Each is engaged under a written contract governing that processing. Where a subprocessor is established outside the EU/EEA, transfers rely on the safeguards set out in our Data Processing Agreement.
| Subprocessor | Purpose | Location | Data Types |
|---|---|---|---|
| UpCloud Ltd. | Cloud infrastructure and compute | Germany (Frankfurt) | All service data |
| Neon Inc. | Managed PostgreSQL database — the primary store for all application data | Germany (Frankfurt), on AWS eu-central-1. Neon Inc. is incorporated in the USA, and Amazon Web Services is its subprocessor. | All service data at rest: accounts, credentials, tenants, vendor and risk records, documents and audit records |
| Cloudflare, Inc. | DNS, reverse proxy, TLS termination, DDoS protection and rate limiting for velador.co and app.velador.co; hosting of this website and the serverless functions behind its contact and waitlist forms; website visitor analytics | Global edge network. Cloudflare, Inc. is incorporated in the USA. | TLS is terminated at Cloudflare, so it processes the full content of every request to and response from the application, including sign-in credentials, session tokens and all personal data in API traffic, together with IP addresses and request metadata. On this website it additionally processes contact-form and waitlist submissions, and collects page-view analytics (IP address, browser, page URL, referrer). |
| Brevo SAS | Transactional email from the application (account verification) | France (EU) | Email address, display name, message content |
| Mailjet SAS | Email sent from this website (contact form, early-access waitlist) | France (EU) | Name, email address, company, and message content you submit in a form |
| Google LLC — Sign in with Google | Optional "Sign in with Google" authentication | USA / global | For users who choose it: Google receives the sign-in request (IP address, browser, and the fact that the account is signing in to Velador) and returns the account's email address, name, profile picture and a persistent account identifier. |
| Microsoft Corporation — Sign in with Microsoft | Optional "Sign in with Microsoft" authentication (Microsoft Entra ID) | USA / global | For users who choose it: Microsoft receives the sign-in request (IP address, browser, and the fact that the account is signing in to Velador) and returns the account's email address or user principal name, display name and a persistent account identifier. |
| Anthropic PBC | AI text assistance in the content editor | USA | The text submitted for processing and the surrounding editor content, including any personal data it contains |
| OpenAI, L.L.C. | AI text assistance in the content editor, and generation of content from an uploaded PDF or a supplied web page | USA | The text submitted for processing, and the extracted text of any PDF or web page supplied, including any personal data it contains |
| Google LLC — Gemini API | AI assistance across compliance features — answering questions about your ISMS documents, and analysing audit checklists, evidence and findings | USA / global | The question asked and extracts of the relevant records: document content, control and clause text, evidence descriptions, risk summaries and audit findings, including any personal data those records contain |
| Pexels | Stock photography. Images are searched from our servers and are loaded into your browser directly from Pexels. | Global content delivery network | Search terms sent from our servers. When an image is displayed, your browser sends your IP address, browser type and the page you are viewing to Pexels. |
Where your data is processed
Where we can, we choose subprocessors that process data in the EU. The servers and database that hold your application data (UpCloud, Neon) are in Frankfurt, Germany, and the email we send is handled in France (Brevo, Mailjet).
Some services we rely on are operated by providers established in the United States: our DNS, CDN and website host (Cloudflare), optional Google and Microsoft sign-in, the AI features (Anthropic, OpenAI, Google), and stock photography (Pexels). Because Cloudflare terminates TLS, it processes the content of requests to the application as well as routing them. Transfers of personal data to these providers rely on the safeguards set out in our Data Processing Agreement.
Change Notifications
We will notify customers of any changes to this subprocessor list at least 30 days before the change takes effect. You can subscribe to notifications by emailing dpa@velador.co.
Questions?
If you have questions about our subprocessors or data processing practices, contact us at privacy@velador.co.
Related Documents
This list should be read in conjunction with our Data Processing Agreement, Privacy Policy, and Terms of Service.