Subprocessors
Last updated 28 July 2026 · draft placeholder, not final
1. What this page is
This page lists the third parties Veela uses to provide the service, drawn directly from what the codebase actually sends to each one, not a generic vendor list. It is a companion to the privacy policy, in particular its AI processing and data residency sections. Locations marked [REVIEWER: confirm] are not pinned in code or configuration sighted for this page and need confirming against the relevant vendor agreement before this page is treated as final.
2. Subprocessors
| Subprocessor | Purpose | Data categories | Location |
|---|---|---|---|
| Anthropic | AI model calls behind drafting, the Checker, Ask Veela, and document extraction (including ASIC statement import). | Varies by feature. Resolution drafting sends name, role and email of officers/members plus constitution and register extracts. ASIC statement import sends the entire uploaded PDF, which contains officer dates of birth and residential addresses. Documents marked “use as context” are summarised and fed into Ask Veela answers. | [REVIEWER: confirm — no region is pinned in code (src/lib/ai/client.ts instantiates the SDK with no region option); confirm Anthropic's applicable processing location and the data retention/training terms in the executed order form]. |
| Vercel | Application hosting, and Blob storage for uploaded documents. | All application traffic; uploaded documents and their extracted text at rest in Blob storage. | [REVIEWER: confirm hosting/Blob region(s) — not pinned in code]. |
| Neon (Postgres) | Primary application database — accounts, company records, registers, minute book, audit logs. | All personal information and register data described in the privacy policy. | Sydney recommended in project configuration (.env.example notes “on Vercel point this at Neon (Sydney region recommended)”). [REVIEWER: confirm the region actually provisioned for production]. |
| Stripe | Billing, subscription management, trials and GST-compliant invoicing. | Payment card details, billing name and address, subscription and invoice history. Card details go directly to Stripe and never touch Veela's servers. | [REVIEWER: confirm — Stripe processes globally; confirm the data-processing terms and region relevant to Australian merchants under the executed Stripe agreement]. |
| Resend | Transactional email — password reset, invitations, notifications, and signatory signing links. | Recipient email address, name where included in the message, and the email body (which may include a signing link or notification content). | [REVIEWER: confirm — not pinned in code]. |
| Sentry | Server error reporting, when a Sentry DSN is configured for the environment. | Error messages, stack traces, and request metadata (path, method, route type). Not intentionally used to send personal information, but an error message could incidentally include fragments of request data. | [REVIEWER: confirm — not pinned in code]. |
3. Why the AI row looks different by feature
Not every AI-assisted feature sends the same amount of personal information. Ordinary resolution drafting (src/lib/resolutions/drafter.ts) grounds on officer/member name, role and email plus register and constitution extracts — it does not send full addresses or dates of birth. ASIC statement import (src/lib/import/asic-statement.ts) is different in kind: it sends the entire uploaded ASIC company statement PDF to the model so officer details can be extracted, and that PDF routinely contains officer dates of birth and residential addresses. Both paths go to the same subprocessor (Anthropic); the difference is what each feature includes in its request. See the privacy policy’s AI processing section for the fuller explanation and what is (and is not) contractually committed on retention and training use.
4. Changes
We will update this page when we add, remove or materially change a subprocessor. Material changes will be notified in-product, consistent with the terms of service.
5. Contact
Questions about this list can be sent to support@tokeniser.com.