Subprocessors

1. Active subprocessors

• HostingerActive

  Entity

  Hostinger group company named in Oceanx's hosting account (Hostinger's DPA lists Hostinger International Ltd., Cyprus)

  Purpose

  Runs the Vendarity application server and its PostgreSQL database.

  Data

  All workspace records, account and sign-in records, and files while they are being scanned.

  Location

  Malaysia (Kuala Lumpur), as measured from the server's network registration. Our confirmation of the data centre with Hostinger is pending.

  Status

  In use.

  Terms

  Hostinger Data Processing Agreement for Hostinger

• Backblaze B2Active

  Entity

  Backblaze, Inc. (United States)

  Purpose

  Stores evidence files, page previews, exports, organization logos, deletion records and signed audit digests.

  Data

  Uploaded documents and images, their previews and export files. File names in storage are random identifiers, not personal names.

  Location

  United States East region (Reston, Virginia; endpoint us-east-005). Backblaze offers no Australian region.

  Status

  In use. Files are encrypted at rest by Backblaze (SSE-B2, AES-256).

  Terms

  Backblaze DPA (UK) for Backblaze B2 · Backblaze subprocessors for Backblaze B2

• CloudflareActive

  Entity

  Cloudflare, Inc. (United States)

  Purpose

  DNS, TLS encryption in transit and network protection for vendarity.com. Every page, download and API request passes through Cloudflare.

  Data

  Web traffic, including IP addresses, browser details and the content of pages and downloads in transit.

  Location

  Cloudflare's global network, nearest to the visitor.

  Status

  In use.

  Terms

  Cloudflare Customer DPA for Cloudflare · Cloudflare subprocessors for Cloudflare

• ResendActive

  Entity

  Plus Five Five, Inc. (United States), trading as Resend

  Purpose

  Sends account emails (verification, password reset, notices) and, when a workspace sends requests, supplier request and reminder emails. Receives supplier email replies once reply intake is switched on.

  Data

  Recipient names and email addresses, message content and delivery events; attachments in supplier replies.

  Location

  United States. Resend stores account data, email metadata and logs in the United States whatever sending region is used.

  Status

  In use for account emails. Supplier email and reply intake are switched on separately.

  Terms

  Resend DPA for Resend · Resend subprocessors for Resend

• Google Gemini API (paid services)Active

  Entity

  Google LLC (United States)

  Purpose

  Suggests document details (for example issuer and expiry date) when a workspace has opted in to AI-assisted review and a reviewer asks for suggestions on a file.

  Data

  Page images and the text of the document a reviewer selects. No supplier contact list, notes or decisions are sent.

  Location

  Google says paid-service data may be stored transiently or cached in any country where Google or its agents have facilities.

  Status

  Available. Each workspace must opt in; Owners and Admins can turn it off at any time.

  Terms

  Gemini API terms for Google Gemini API (paid services) · Gemini API abuse monitoring for Google Gemini API (paid services)

2. Approved but not yet active

These providers are integrated but switched off. They receive no personal information until the feature starts, and we will update this page when it does.

• CellcastNot yet active

  Entity

  Cellcast Australia Pty Ltd (Prahran, Victoria, Australia) and its regional platforms

  Purpose

  Would deliver optional SMS reminders to supplier contacts who opt in.

  Data

  Mobile number, the message text (buyer name, number of open requests and an opt-out link) and delivery and opt-out records.

  Location

  Australia for Australian and New Zealand numbers (Cellcast describes AWS servers in Sydney); Cellcast's North American and UK platforms for US, Canadian and UK numbers.

  Status

  Not yet active. No SMS has been sent. Each country route starts only after sender registration and a supervised test.

  Terms

  Cellcast privacy policy for Cellcast

• Stripe (Managed Payments)Not yet active

  Entity

  Stripe, with Sold through Link, LLC as merchant of record for Managed Payments sales

  Purpose

  Would sell paid subscriptions, collect payment and applicable tax, issue receipts and invoices, and handle payment support and refunds.

  Data

  Billing contact, billing address, tax identifiers, payment method and transaction records. Card details are entered on Stripe's pages and never reach Vendarity.

  Location

  Stripe's global infrastructure.

  Status

  Not yet active. Paid subscriptions are not on sale; trials need no card.

  Terms

  How Managed Payments works for Stripe (Managed Payments) · Stripe privacy policy for Stripe (Managed Payments)

3. Services that receive no customer data

• GitHub: Holds Vendarity's source code and runs automated checks on fictional test data. Its hourly monitor reads only the public status page, which contains no customer information.
• Let's Encrypt and ClamAV signature mirrors: Issue our server certificate and supply malware signatures. Files are scanned on our own server; nothing is sent to them.

4. Changes and objections

We will update this page and email workspace Owners at least 30 days before a new or replacement subprocessor starts processing customer personal data, except in an emergency, when we will tell you as soon as possible. You can object on reasonable data protection grounds during that period, as the Data Processing Addendum explains.

A separate backup location for database and file recovery copies is being set up. It is not yet in use and will be added here, with its provider and region, before it starts.