™Core subprocessors
| Provider | Purpose and information | Location note |
|---|---|---|
| Cloudflare, Inc. | Hosting, network delivery and protection, managed application database, and encrypted file storage. Processes service traffic, workspace records, uploaded files, and security information. | Canada and Cloudflare's global network, subject to its service configuration and terms. |
| Supabase, Inc. | Authentication, account verification, multifactor authentication, password recovery, and protected team invitations. Processes account identifiers, email, authentication records, and security metadata. | The configured project region and Supabase subprocessors. |
| Stripe, Inc. and affiliates | Subscription checkout, payment method collection, recurring billing, billing portal, tax related checkout fields, and payment status. Vanteloq receives references and status, not full card numbers. | Canada, the United States, and other locations described by Stripe. |
| Resend, Inc. | Transactional email delivery, such as an invoice email initiated by an authorized user. Processes recipient, sender, subject, message content, and delivery metadata. | The United States and provider locations described by Resend. |
| Canada Post AddressComplete | Customer directed business address search and validation. Processes the address search text, country, returned suggestion identifier, and requested address result. | Canada and locations identified in the AddressComplete service terms. |
| Google LLC, Google Analytics | Optional public website measurement after the visitor explicitly allows analytics. Processes page paths without URL query text, device and browser context, approximate region, timestamps, and configured interaction events. Advertising signals and ad personalization remain disabled. | The United States and other locations described in Google's service materials. |
Optional customer directed services
These services receive information only after an authorized user enables the relevant feature and completes the displayed provider and Vanteloq controls. Their own terms and privacy materials also apply.
- Cloudflare Email Routing and Email Workers: optional document forwarding after workspace authorization and storage consent. Processes incoming email to send supported attachments to Vanteloq's existing private quarantine. Vanteloq retains originals, limited receipt metadata and an unverified sender address under its document retention controls, without keeping the email body. Cloudflare states that Email Routing does not store email content; delivery and security metadata and mailbox copies follow their own retention rules. This feature does not automatically scan documents, send them to AI or post accounting entries.
- Microsoft Azure Blob Storage and Defender for Storage: temporary document security scanning when configured and an authorized user chooses Scan and Read. Receives the selected file under a random identifier in a private container. The application checks the file identity and a completed malware scan before releasing the original. Scanning copies are deleted after a confirmed result; interrupted copies remain subject to the scanning storage expiry policy. Azure storage recovery can retain deleted copies for 7 days. Scanning takes place in the configured storage region. Customer storage credentials and original filenames are not sent with the file.
- Microsoft Azure Document Intelligence: document extraction after a clean security scan. Receives the file to read text, tables, invoice and receipt fields. Proposed figures stay subject to review. Vanteloq requests deletion of Azure's temporary analysis copy after saving the result; Microsoft documents automatic deletion after 24 hours. Processing takes place in the selected Azure region. These actions do not send the document to OpenAI or automatically post accounting entries.
- Plaid: read only business financial account connection, balances, and transactions selected by a workspace owner.
- Google: selected marketing resources and Business Profile information after the specific authorization and resource selection shown in Vanteloq. Google does not provide Vanteloq AI responses.
- OpenAI: optional Vanteloq AI analysis using the question, permission-filtered business and financial KPIs and bounded conversation context, only when configured and selected with affirmative acceptance. Processing may occur in the United States and other provider locations. Requests disable stored response objects; provider safety retention can still apply.
- Meta: selected marketing account and measurement records.
- Intuit QuickBooks Online: a customer selected company identifier, company name, authorization status, and accounting records only when the staged accounting import is later enabled and expressly authorized.
- Shopify, Square, Clover, Lightspeed, Stripe Connect, and Moneris: customer directed commerce, payment reference, product, inventory, location, or reporting records available under the permissions shown during connection.
Placeholder integrations shown as unavailable do not receive Customer Data.
Changes and questions
This notice is updated before a new core subprocessor begins materially different processing. Customers may use our private contact form for current provider information or to raise a reasonable data protection objection.