About Sub-Processors
Valiyou uses carefully selected third-party service providers (sub-processors) to deliver our platform. All sub-processors have appropriate data protection agreements in place, including Standard Contractual Clauses (SCCs) for non-EU transfers.
Customer Rights: You will be notified 30 days in advance of any new sub-processor. You have the right to object within this period.
Supabase
Supabase, Inc.
Location
USA (company) / EU (data hosting - AWS eu-west-1 Dublin, Ireland)
Purpose
PostgreSQL database hosting, authentication infrastructure
Data Processed
All customer data
Safeguards
Data stored in EU, GDPR-compliant, ISO 27001, SOC 2 Type II
Vercel
Vercel Inc.
Location
USA (company) / EU (functions - Paris, Stockholm, Frankfurt)
Purpose
Web application hosting, serverless functions, CDN
Data Processed
Technical data, logs, session data
Safeguards
Standard Contractual Clauses (SCCs), ISO 27001:2022, SOC 2 Type II
GitHub
Microsoft Corporation / GitHub, Inc.
Location
USA (Global CDN with data replication)
Purpose
Source code hosting, version control, CI/CD pipelines (GitHub Actions), security scanning (CodeQL, Dependabot, Secret Scanning)
Data Processed
Source code, configuration files, commit history, workflow logs, security scan results
Safeguards
EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), SOC 2 Type II
Cloudflare
Cloudflare, Inc.
Location
USA (Global CDN with EU data centers)
Purpose
DNS management, CDN, DDoS protection, Web Application Firewall (WAF)
Data Processed
IP addresses, HTTP request headers, DNS queries, cached content
Safeguards
EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), EU data processing available
Stripe
Stripe, Inc. / Stripe Payments Europe, Ltd.
Location
USA / Ireland (EU entity available)
Purpose
Payment processing, subscription management, invoicing
Data Processed
Billing details, payment methods, transaction history
Safeguards
PCI DSS Level 1, EU-U.S. Data Privacy Framework, SCCs, EU data residency
Resend
Resend, Inc.
Location
USA
Purpose
Transactional emails (verification, password reset, invitations, notifications)
Data Processed
Email addresses, names, email content
Safeguards
Standard Contractual Clauses (SCCs)
Google (reCAPTCHA & Gemini)
Google LLC
Location
USA
Purpose
Bot detection, fraud prevention, AI-powered insights (if AI Insights enabled)
Data Processed
IP addresses, browser fingerprints, reCAPTCHA scores, valuation data (AI only)
Safeguards
EU-U.S. Data Privacy Framework, SCCs
OpenAI
OpenAI, L.L.C.
Location
USA
Purpose
AI-powered insights generation (if AI Insights plugin enabled)
Data Processed
Valuation data, business metrics
Safeguards
SCCs, OpenAI does not use API data to train models
Groq
Groq, Inc.
Location
USA
Purpose
AI-powered insights generation (if AI Insights plugin enabled)
Data Processed
Valuation data, business metrics
Safeguards
Standard Contractual Clauses (SCCs)
Anthropic
Anthropic, PBC
Location
USA
Purpose
In-app AI assistant (chat) and AI-powered insights generation (if AI Insights plugin enabled)
Data Processed
Chat messages, current page content, organization data the assistant looks up (valuations, sponsors, contacts); valuation data and business metrics (AI Insights)
Safeguards
Standard Contractual Clauses (SCCs), API data is not used for model training
Mux
Mux, Inc.
Location
USA
Purpose
Video hosting for auth page background video
Data Processed
None (public video playback only)
Safeguards
Standard Contractual Clauses (SCCs)
Mintlify
Mintlify, Inc.
Location
USA
Purpose
Documentation hosting (docs.valiyou.com)
Data Processed
IP addresses, user analytics, page views
Safeguards
Standard Contractual Clauses (SCCs), SOC 2 Type II compliant
CookieYes
CookieYes Limited
Location
Ireland (EU)
Purpose
Cookie consent banner, consent tracking
Data Processed
Consent preferences, IP addresses
Safeguards
GDPR compliant, EU-hosted
Better Stack (Uptime)
Better Stack, Inc.
Location
USA (EU data centers available)
Purpose
Uptime monitoring, incident management, status page hosting
Data Processed
HTTP request metadata, response times, uptime status
Safeguards
Standard Contractual Clauses (SCCs), EU data storage available
Questions about our sub-processors?
Contact our Trust Center team for more information about data processing or to exercise your objection rights.
Contact Trust Center