Sub-processors
Vendors who process customer data on Nervos’s behalf.
We notify customers at least 30 days before any change to this list.
Register
What each vendor processes, where, and under which terms.
| Vendor | Purpose | Region | Data types | DPA |
|---|---|---|---|---|
| Supabase | Postgres database + auth + RLS | US-West (Oregon) | Customer org data, profiles, audit logs, encrypted connector tokens | In place |
| Vercel | Application hosting + edge compute | Multi-region (auto-selected by Vercel) | HTTPS request/response and application logs; page views, custom interaction events and page-load performance metrics (Web Analytics, Speed Insights) | In place |
| Stripe | Billing + subscription management | US | Customer email, billing address, payment instrument metadata (PCI-DSS scoped at Stripe) | In place |
| Resend | Transactional email delivery | US | Recipient email, message content (magic links, invitations, notifications) | In place |
| Groq | Model inference for analyses | US | Prompt content (strategic objectives) and inference outputs; no retention per Groq policy | Standard provider terms |
| OpenAI | Embeddings for semantic memory (optional — only when configured) | US | Text of decision objectives and memory entries, sent to compute embeddings | Enterprise terms (no training on inputs) |
| Upstash | Distributed rate limiting + circuit breaker | US | Hashed rate-limit counters only — no personal data | In place |
| PostHog | Product analytics on the public site only: page views, clicks, scroll depth and named product events. Session recording is turned off in our code. | US | A pseudonymous visitor identifier, page URLs and the elements clicked, named product events from a fixed list (a demo, pilot or plan link clicked, a walkthrough step reached, a demo request sent, received or failed — never what is typed into the form), browser and device details, and the IP address the request arrives from | Not yet confirmed |
Supabase
Postgres database + auth + RLS
- Region
- US-West (Oregon)
- DPA
- In place
- Data types
- Customer org data, profiles, audit logs, encrypted connector tokens
Vercel
Application hosting + edge compute
- Region
- Multi-region (auto-selected by Vercel)
- DPA
- In place
- Data types
- HTTPS request/response and application logs; page views, custom interaction events and page-load performance metrics (Web Analytics, Speed Insights)
Stripe
Billing + subscription management
- Region
- US
- DPA
- In place
- Data types
- Customer email, billing address, payment instrument metadata (PCI-DSS scoped at Stripe)
Resend
Transactional email delivery
- Region
- US
- DPA
- In place
- Data types
- Recipient email, message content (magic links, invitations, notifications)
Groq
Model inference for analyses
- Region
- US
- DPA
- Standard provider terms
- Data types
- Prompt content (strategic objectives) and inference outputs; no retention per Groq policy
OpenAI
Embeddings for semantic memory (optional — only when configured)
- Region
- US
- DPA
- Enterprise terms (no training on inputs)
- Data types
- Text of decision objectives and memory entries, sent to compute embeddings
Upstash
Distributed rate limiting + circuit breaker
- Region
- US
- DPA
- In place
- Data types
- Hashed rate-limit counters only — no personal data
PostHog
Product analytics on the public site only: page views, clicks, scroll depth and named product events. Session recording is turned off in our code.
- Region
- US
- DPA
- Not yet confirmed
- Data types
- A pseudonymous visitor identifier, page URLs and the elements clicked, named product events from a fixed list (a demo, pilot or plan link clicked, a walkthrough step reached, a demo request sent, received or failed — never what is typed into the form), browser and device details, and the IP address the request arrives from
Notice of sub-processor changes: security@thenervos.com. Last updated: October 13, 2026.
Next
Every control, what enforces it, and where it stops.
The security page documents what is implemented, what enforces each control, and where a control is still partial.