Supabase
Postgres database + auth + RLS
- Region
- US-West (Oregon)
- DPA
- In place
Customer org data, profiles, audit logs, encrypted connector tokens
Sub-processors
Vendors who process customer data on Nervos’s behalf. We notify customers at least 30 days before any change to this list.
| Vendor | Purpose | Region | Data types | DPA |
|---|---|---|---|---|
| Supabase | Postgres database + auth + RLS | US-West (Oregon) | Customer org data, profiles, audit logs, encrypted connector tokens | In place |
| Vercel | Application hosting + edge compute | Multi-region (auto-selected by Vercel) | HTTPS request/response (no persistent storage) | In place |
| Stripe | Billing + subscription management | US | Customer email, billing address, payment instrument metadata (PCI-DSS scoped at Stripe) | In place |
| Resend | Transactional email delivery | US | Recipient email, message content (magic links, invitations, notifications) | In place |
| Groq | LLM inference for QAMO agents | US | Prompt content (strategic objectives) and inference outputs; no retention per Groq policy | Standard provider terms |
| OpenAI | Embeddings for semantic memory (optional — only when configured) | US | Anonymised text embeddings of board outputs | Enterprise terms (no training on inputs) |
| Upstash | Distributed rate limiting + circuit breaker | US | Hashed rate-limit counters only — no personal data | In place |
Supabase
Postgres database + auth + RLS
Customer org data, profiles, audit logs, encrypted connector tokens
Vercel
Application hosting + edge compute
HTTPS request/response (no persistent storage)
Stripe
Billing + subscription management
Customer email, billing address, payment instrument metadata (PCI-DSS scoped at Stripe)
Resend
Transactional email delivery
Recipient email, message content (magic links, invitations, notifications)
Groq
LLM inference for QAMO agents
Prompt content (strategic objectives) and inference outputs; no retention per Groq policy
OpenAI
Embeddings for semantic memory (optional — only when configured)
Anonymised text embeddings of board outputs
Upstash
Distributed rate limiting + circuit breaker
Hashed rate-limit counters only — no personal data
Notice of sub-processor changes: security@thenervos.com. Last updated: July 2026.