Sub-processor Register
Version 2026-10-01. These are the sub-processors Vouli IQ engages to deliver the service. Each is bound by data-protection terms no less protective than our Data Processing Agreement. We notify customers before engaging a new sub-processor.
| Sub-processor | Purpose | Region / safeguard |
|---|---|---|
| Vercel | Application hosting & edge delivery | Japan (Tokyo) for the application; static files from a global edge network |
| Supabase | Managed Postgres database, file storage & vector search | Japan (Tokyo, AWS ap-northeast-1) |
| Clerk | Authentication & user identity | United States (SCCs) |
| Resend | Transactional & notification email | United States (SCCs) |
| Sentry | Error & performance monitoring (PII masked) | United States (SCCs) |
| PostHog | Product analytics, only after consent: anonymous page views and product events, with no person profiles and no screen content | EU/US (SCCs) |
| Dodo Payments | Payments & subscriptions (merchant of record) | Per the Dodo Payments DPA (merchant of record) |
| Anthropic | LLM inference under no-training contractual terms | United States (SCCs) |
| OpenAI | LLM inference under no-training contractual terms | United States (SCCs) |
| Cohere | LLM re-ranking for retrieval (RAG); PII redacted before egress | United States (SCCs) |
| Cloudflare | Bot protection on public forms (Turnstile): processes the visitor’s IP address and browser signals. Applies only when bot protection is enabled | Global edge network; Cloudflare, Inc., United States (SCCs) |
No customer assessment content or strategy data is used to train any third-party model. LLM providers process data only to return the requested output, under contractual no-training terms.