Effective 24 August 2026
Subprocessors
This register describes implemented integrations and the selected hosting plan. It does not establish that every service is deployed or that provider contracts and account controls have been verified. Customer-data use requires those checks and approval of the actual configuration.
Provider register
| Provider | Purpose | Data | Location and verification status |
|---|---|---|---|
| Render | Selected plan: web, private API and worker hosting, managed PostgreSQL, and managed key-value/queue infrastructure | Account, workspace, source, derived, job, audit, and operational data | Frankfurt, Germany selected region; hosted deployment unverified |
| Cloudflare R2 | Encrypted object storage for approved uploads and source snapshots | Uploaded files, source snapshots, and associated object metadata | Existing storage reported by the operator; EU endpoint and account controls require verification |
| OpenAI | Enabled workbook interpretation, extraction, embeddings, and coach-visible AI features | Bounded source excerpts, service instructions, generated outputs, and request metadata | United States and other documented service locations, with contractual transfer safeguards |
| Resend | Transactional account and service email delivery | Recipient name/address, message content, delivery and security metadata | United States and documented service-provider locations |
| Stripe | Checkout, subscriptions, billing portal, payment status, tax and fraud controls | Business contact, billing, subscription, payment and fraud metadata; Vordian does not store full card details | United States and documented Stripe service locations |
| Grafana Cloud | Redacted logs, metrics, traces, synthetic monitoring, and consented browser reliability telemetry | Operational, performance, error and security metadata; source content and direct identifiers are excluded by policy | UK or EU region selected; production binding and retention require verification |
Google integrations
Google is an external service chosen by the user rather than a general Vordian subprocessor. Vordian uses Google account identity for sign-in and, only after separate connection consent and an OAuth grant, uses per-file Google access to explicitly added files. Google permits editing those files; Vordian only reads them and imports approved spreadsheets. Google's own terms govern the customer's Google account and files; Vordian's handling of data received through the APIs remains subject to its Privacy Policy and Google's Limited Use requirements.
Changes and objections
Vordian will update this page before a new provider begins material processing and will change the effective date. A customer may object on reasonable data-protection grounds by emailing privacy@vordian.app. The objection process in the Data Processing Terms applies.
Contact privacy@vordian.app for transfer-safeguard or provider questions.