Vera AI · Security

Subprocessors

Data processing addendum Trust center Download the review guide (PDF)

Everyone who touches the service. The complete list of subprocessors we use to run Vera AI, what each one does, the data it handles and where it processes it. This is Annex 3 of the data processing addendum, kept current. Last updated October 1, 2026.

THE SECURITY REVIEW Security overview Security and data FAQ Data processing addendum Subprocessors Trust center Responsible disclosure Security review package Security and data review guide (PDF)

SUBPROCESSOR	PURPOSE	DATA TOUCHED	LOCATION
Supabase Postgres and file storage	Database and private file storage (Postgres, storage buckets), encrypted at rest	Contract documents, application data	United States
Vercel application hosting	Application hosting and edge network	Application traffic	United States
Anthropic document analysis and written AI answers	AI model API (Claude), called server side for document analysis and every written AI answer; API data is not used to train models	Contract text and questions sent for AI features; larger documents are held as files on our Anthropic account so they are not re-sent on every turn	United States
OpenAI voice, transcription and live market lookups	Vera's voice on calls and in meetings, speech to text, text read aloud, and the public web lookup she runs during a call	Audio from the calls and meetings where you use the voice features, their transcripts, the text read aloud, and the deal facts Vera looks up to answer	United States
Voyage AI document search embeddings	Embeddings that power document search	Contract text, split into passages when a document is indexed, and the search questions asked against it	United States
Recall.ai the meeting seat	The meeting participant that joins a Zoom, Teams or Meet call when you seat Vera in it	Audio and transcript, with participant names, of the meetings you seat Vera in	United States
ElevenLabs live call transcription	Speech to text for the live call copilot, and the vendor's voice in negotiation rehearsal	Audio segments from calls where the copilot is listening, and rehearsal lines	United States
HeyGen (LiveAvatar) the optional video face	Renders the optional video face while Vera speaks	The audio of Vera's spoken answers; no microphone audio and no documents	United States
Cloudflare meeting audio relay and the public site	Relays meeting audio between the meeting seat and the voice model, and serves the marketing site and the public contract decoder	Meeting audio in transit for meetings where Vera is seated, and decoder traffic in transit	Global edge
Resend transactional email	Transactional email delivery, and receiving the email you forward in	Recipient name and email, notification content, forwarded messages	United States
Upstash rate limiting and a short-lived cache	Rate limiting and a short-lived cache (Redis)	Request counters keyed by user or IP, and cached AI results that expire on a timer	United States

Last updated October 1, 2026. 11 providers.

Voice, call and meeting features only

OpenAI, Recall.ai, ElevenLabs, HeyGen (LiveAvatar) and Cloudflare's audio relay are on the path only for the voice, call and meeting features. A workspace that never uses those features sends them nothing.

How a provider gets on this list

A provider is listed when production sends it customer data: the code calls it and its credentials are set on the production deployment. When a new provider is wired, its row is added in the same change, with what it actually receives.

Notice before a change

We give at least thirty days notice before adding or replacing a subprocessor that touches contract data, and you may object on reasonable data protection grounds under the addendum. Questions to info@vendorbenchmark.com.

THE AI DATA FLOW

What leaves, to whom, and what comes back.

Read once on upload, then only when you act

An uploaded document is read once, automatically, to index it for search and fill in its key terms. Every analysis after that runs only when a member of your organization starts it. No training job reads your documents.

What leaves, and to whom

Written analysis goes to Anthropic (Claude). Document passages for search go to Voyage AI. Call and meeting audio goes to OpenAI and the voice providers, only when you use Vera's voice. Nothing goes to an ad network or a third-party analytics service; every provider is on the subprocessor list.

What comes back, and where it lives

The analysis returns to your tenant and is stored under the same row-level security as the document it came from.

Retention and training

Anthropic and OpenAI do not use API data to train models, and the zero-data-retention addendum with Anthropic is signed.

Attribution

Every AI run is metered and attributable to the user and organization that ran it, so your admins can see who analyzed what.

CHANGES TO THIS LIST

Thirty days notice before a provider that touches contract data changes.

Ask us to notify your security or privacy contact when the list changes, and we add them to the notice. The addendum gives you the right to object on reasonable data protection grounds.

Ask for change notices →