Trust and privacy
Subprocessor Inventory
Verdan uses the subprocessors below to operate the platform. This GDPR Article 28 public summary supports procurement and privacy review; contract packets may include additional vendor evidence. This page is static at build time and does not call provider APIs or read secrets.
Last updated: 2026-08-15
A
Anthropic
Anthropic, PBC — 548 Market St, PMB 90375, San Francisco, CA 94104, USA
- Data categories
- User prompts, document snippets, extracted compliance metadata
- Retention
- Vendor-managed; governed by contracted DPA and product controls
O
OpenAI
OpenAI, L.L.C. — 1960 Bryant Street, San Francisco, CA 94110, USA
- Data categories
- User prompts, document snippets, extracted compliance metadata
- Retention
- Vendor-managed; API data not used for model training; governed by contracted DPA
S
Stripe
Stripe, Inc. — 354 Oyster Point Blvd, South San Francisco, CA 94080, USA
- Data categories
- Billing contact, subscription, payment event metadata; customer email/name redacted during GDPR erasure
- Retention
- Payment records retained by Stripe for legal and tax obligations; billing contact data subject to GDPR erasure via API
B
Bird
Bird B.V. — Keizersgracht 268, 1016 EV Amsterdam, Netherlands
- Data categories
- Phone numbers, SMS message bodies (one-time codes and notifications), delivery metadata
- Retention
- Vendor-managed SMS logs; DSAR/delete uses manual Bird privacy request
T
Telnyx
Telnyx LLC — 600 Congress Ave, Austin, TX 78701, USA
- Data categories
- Legacy inbound-only: phone numbers and STOP/START keyword messages on the old number; no outbound SMS
- Retention
- Vendor-managed SMS logs; DSAR/delete uses manual Telnyx support/privacy request until the legacy webhook is retired
R
Resend
Plus Five Five, Inc. d/b/a Resend — 2261 Market Street #4707, San Francisco, CA 94114, USA
- Data categories
- Email address, template metadata, delivery diagnostics
- Retention
- Delivery log bodies accessible to admins for 7 days
S
Supabase
Supabase, Inc. — 970 Toa Payoh North #07-04, Singapore 318992
- Data categories
- Tenant records, user accounts, compliance documents, audit metadata
- Retention
- Application retention and backup policy
C
Cloudflare
Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA
- Data categories
- HTTP metadata, object storage records, edge logs
- Retention
- Log and object lifecycle policy
V
Vercel
Vercel Inc. — 340 S Lemon Ave #4133, Walnut, CA 91789, USA
- Data categories
- Web request metadata, build/deploy metadata, environment-scoped application data
- Retention
- Logs retained per Vercel plan and project settings
S
Sentry
Functional Software, Inc. d/b/a Sentry — 45 Fremont St, 8th Floor, San Francisco, CA 94105, USA
- Data categories
- Error stack traces, request IDs, route metadata, scrubbed user context
- Retention
- Event retention per Sentry project settings
R
RB2B
RB2B (when enabled): marketing-site visitor identification only
- Data categories
- Marketing-page visits, IP-derived company and professional-profile matches
- Retention
- Per RB2B account settings
U
Upstash
Upstash, Inc. — 2261 Market Street #4891, San Francisco, CA 94114, USA
- Data categories
- Cache keys, rate-limit counters, transient metadata
- Retention
- TTL-driven cache retention
E
Expo
650 Industries, Inc. d/b/a Expo — 2810 N Church St, Wilmington, DE 19802, USA
- Data categories
- Push tokens, notification payloads, build metadata
- Retention
- Push/build metadata per Expo terms and project settings
P
PowerSync
JourneyApps (PowerSync) — 6th Floor, 80 Strand Street, Cape Town, 8001, South Africa
- Data categories
- Tenant-scoped sync data, sync credentials, device metadata
- Retention
- Sync retention governed by Verdan sync policy and vendor terms
S
Serper
Serper — vendor-managed search API provider
- Data categories
- Search query text and response metadata
- Retention
- Request logs per vendor terms
Current DPA and subprocessor references are maintained in Verdan's procurement evidence file and re-verified before contract signature. Verdan is designed to support auditability and production readiness review without claiming a completed certification before legal verification is finished.
Data residency: pilot production runs on a single United States Supabase project and US/default-region infrastructure; Verdan does not yet route EU tenants to EU-only hosting. EU residency requires a separate regional deployment plan before contract signature.
For procurement review, request a demo and ask for the current vendor evidence packet, or contact privacy@verdansafety.com.
