Legal
Sub-processors
Last updated: 29 October 2026
Who helps us run Vaario
Vaario uses the providers below to run the service. A sub-processor is a provider that handles personal data on our behalf. For the text of your documents we act as your processor, and these are the providers we use for it. This page is part of the privacy policy and becomes effective with it.
| Provider | What it does | What it receives | Where | Your documents? |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All account data, encrypted document text, metadata | EU — Ireland (eu-west-1) | Yes — stored encrypted at rest |
| Amazon Web Services | AI language model (Claude via Amazon Bedrock) | Document text excerpts, per request | EU only — Ireland, Germany, Sweden, France, Italy, Spain | Yes — excerpts, processed in memory for each request |
| Vercel | Frontend hosting and edge delivery | IP addresses, browser headers | Global CDN; EU nodes serve EU traffic | No |
| Railway | Backend API hosting | Email (in request logs), data in transit | EU region | In transit only — the service does not keep documents |
| Cloudflare | DNS for the website and the API, network security in front of the API, and the bot check on the sign-in page (Turnstile) | IP addresses and request metadata for the API; traffic to the API passes through it; on the sign-in page, your IP address and browser signals so the bot check can tell a person from a script | Global network | In transit only — API requests, including uploads, pass through; nothing is stored |
| Resend | Transactional email delivery — including review notes you send, and any contract text quoted in them | Email addresses; and, when you email your review notes to someone, the notes and any contract text quoted in them | United States | Only text you choose to send in review notes |
Transfers outside the EU
Our database and every AI request stay in the EU. Providers marked SCCs are ones whose network or company reaches outside the EU/EEA; for them we rely on the Standard Contractual Clauses approved by the European Commission. Sending review notes by email is the one place where contract text you choose to send leaves the EU. The privacy policy explains this, and the limits of EU-only processing, in full.
Changes to this list
We give at least 30 days' notice before adding or replacing a sub-processor, by updating this page and emailing the address on each account. If you object to a new sub-processor for a reasonable data-protection reason, write to privacy@vaario.app before the change takes effect and we will talk it through with you.