Trust

Sub-processors

A provider appears here if the current code can send it personal data. Conditional services process data only when the matching feature is enabled or chosen.

Effective and last updated 13 July 2026. This version describes Veillo’s current service and production requirements. Product guidance is not legal advice.

Core production hosting uses Vercel. Other entries depend on deployment configuration, a purchase, consent, or an integration choice. This distinction prevents a broad vendor list from implying that every provider receives every customer’s data.

Vercel, Inc.

Provider terms ↗

Service: Application hosting, deployment, delivery, security, and logs
Activation: Production website and application
Data: Request data, account and workspace data processed by server functions, technical logs
Location: Primary server-function region is Frankfurt, Germany (fra1). Vercel also operates global delivery, security, support, and control-plane services.
Transfer safeguards: Vercel data processing terms and Standard Contractual Clauses where required

Neon, Inc.

Provider terms ↗

Service: Managed PostgreSQL database
Activation: Production DATABASE_URL uses Neon
Data: Accounts, organisations, compliance records, documents, and audit entries
Location: Veillo's production standard is an EU database region in Frankfurt. The selected Neon project region must be checked before launch and after any database migration.
Transfer safeguards: Neon data processing terms and Standard Contractual Clauses where required

Stripe Payments Europe, Limited

Provider terms ↗

Service: Subscription checkout, billing, payment, invoicing, and tax support
Activation: A customer buys or manages a paid subscription
Data: Billing contact, plan, transaction, tax, and payment metadata; Veillo does not receive full card details
Location: European Economic Area and other locations described in Stripe's privacy documentation
Transfer safeguards: Stripe data processing terms, adequacy mechanisms, and Standard Contractual Clauses where required

SMTP2GO Pty Ltd

Provider terms ↗

Service: Transactional email delivery
Activation: SMTP2GO is the configured email provider
Data: Recipient name and email, message content, and delivery metadata
Location: Locations described in SMTP2GO's privacy and data processing terms
Transfer safeguards: Provider data processing terms and Standard Contractual Clauses where required

Resend, Inc.

Provider terms ↗

Service: Transactional email delivery
Activation: Resend is configured and SMTP2GO is not configured
Data: Recipient name and email, message content, and delivery metadata
Location: United States and other locations described in Resend's terms
Transfer safeguards: Provider data processing terms and Standard Contractual Clauses where required

Amazon Web Services EMEA SARL

Provider terms ↗

Service: Claude model access through Amazon Bedrock
Activation: A Bedrock model is configured and the user invokes an AI-assisted feature, or the article job runs
Data: Free-text system descriptions submitted for an optional classification suggestion; article briefs for the publishing workflow
Location: EU Bedrock region, configured as eu-central-1 by default, plus AWS operational support locations
Transfer safeguards: AWS data processing terms and Standard Contractual Clauses where required

Functional Software, Inc. d/b/a Sentry

Provider terms ↗

Service: Application error monitoring
Activation: Error monitoring is enabled (NEXT_PUBLIC_SENTRY_DSN is configured)
Data: Error type, message, and stack trace; the page or API path where the error happened; browser and operating system; release version. Veillo strips user identity, cookies, authentication headers, request bodies, and URL query strings before an event is sent, and does not use session replay or performance tracing.
Location: Sentry's EU data storage location in Frankfurt, Germany. Veillo's code refuses any Sentry key that is not on the EU ingest host, so error data cannot be sent to Sentry's US region.
Transfer safeguards: Sentry data processing addendum and Standard Contractual Clauses where required. Browser reports are relayed through veillo.eu rather than sent to Sentry directly, and IP address collection is switched off in the Sentry client configuration.

Google Ireland Limited

Provider terms ↗

Service: Google Analytics 4; optional Google sign-in and Google Workspace discovery
Activation: Analytics consent is granted or a user chooses a Google integration
Data: For Analytics: page, device, referrer, broad location, and interaction data after consent. For connected Google features: identity and requested Workspace audit data.
Location: Google operates globally. International transfers may occur under Google's applicable transfer safeguards.
Transfer safeguards: Google data processing terms, EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses

Change notice

We publish a new sub-processor before it begins processing Customer Data. Active paid customers receive service or email notice where a change is material. Objection rights are in section 7 of the DPA.