Subprocessors

Scope and definition

A subprocessor is a third-party service provider engaged by Civerent that may process customer or personal information to support delivery of the service. The information processed depends on the feature used, the customer's configuration, and the content submitted.

This list covers Civerent's current core production providers. A provider's own documentation, contractual terms, security controls, and processing locations remain provider-controlled.

Current providers

• Netlify — application hosting, deployment, content delivery, and server-side execution. It may process request metadata and information transmitted through the hosted application.
• Supabase — authentication, PostgreSQL database services, storage, and backend infrastructure. It may process account identifiers, organization records, governance content, audit history, and operational data.
• Stripe — hosted checkout, recurring billing, customer portal, invoices, refunds, and tax functionality. Stripe processes payment, account, and billing information. Civerent does not store full card numbers or card verification codes.
• Resend — transactional email delivery and inbound support routing. It may process email addresses, message content, and delivery metadata.

Provider in setup

Amazon Web Services (AWS) — Civerent is configuring Amazon S3 as a destination for encrypted logical PostgreSQL backup archives. The first production upload and isolated restore drill are still pending, so this backup path is not operational and should not be relied on.

Provider diligence

Civerent evaluates providers based on the service being supplied, security and privacy documentation, access requirements, operational importance, and available contractual protections.

No provider relationship removes the customer's responsibility to evaluate whether Civerent and its dependencies satisfy the customer's own legal, regulatory, residency, procurement, and risk requirements.

Changes to this list

Civerent may add, replace, or remove providers as the service evolves. This page will be updated when a material core provider changes, as reasonably practicable.

Where a signed customer agreement includes a specific subprocessor-notice commitment, that agreement controls the notice process.

Customer review

Organizations with regulated workloads, geographic restrictions, government requirements, or negotiated security terms should confirm required regions, contractual provisions, and data-handling constraints with Civerent before relying on the service for those workloads.