Current sub-processors
Ninefold Ltd, which operates Vezna, uses these providers under contracts that bind them to protect the data, as described in our Data Processing Agreement.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| DigitalOcean, LLC | Servers and storage for the Vezna app and every company’s books | All client data: books, documents, conversations; account data | Frankfurt, Germany (EU) | EU hosting region; data processing terms; Standard Contractual Clauses or the EU–US Data Privacy Framework for any access from outside the EU |
| Cloudflare, Inc. | DNS, TLS encryption and network protection; all traffic to app.vezna.ai passes through Cloudflare | Data in transit; IP addresses and request details | Global network; traffic is served from the nearest data centre, which may be outside the EU | Data processing terms; Standard Contractual Clauses or the EU–US Data Privacy Framework |
| Anthropic | AI models (Claude) that read invoices and statements, classify transactions, and power Ask Vezna and the company-profile interview | The documents, transaction details and messages needed for each task | United States | Data processing terms; Standard Contractual Clauses or the EU–US Data Privacy Framework; under Anthropic’s commercial terms, data sent through its API is not used to train its models |
| Only if the client connects them: Google Drive (collecting and filing invoices) and Gmail (collecting invoice emails, searching the mailbox on request, and sending Vezna’s reminders from it). Google sign-in, only if a user chooses it | Documents and emails in the client’s connected Drive folder or mailbox; for sign-in: name, email address and Google account ID | Google’s infrastructure, which may be outside the EU | Google’s data processing terms; Standard Contractual Clauses or the EU–US Data Privacy Framework. Drive and Gmail data stays in the client’s own Google account | |
| Resend | Account emails: invitations and password-reset links | Recipient name and email address; message content | United States | Data processing terms; Standard Contractual Clauses or the EU–US Data Privacy Framework |
| Cloudflare (R2 object storage) | Off-site backups: 14 daily and 8 weekly copies | Copies of all data, encrypted before they leave our servers with a key only Ninefold holds | European Union (R2 EU jurisdiction) | Client-side encryption; Cloudflare Data Processing Addendum; data stays in the EU jurisdiction |
Services that are not our sub-processors
- Banks and payment providers the client connects — Fibank, Revolut Business and Stripe send the client’s data to Vezna at the client’s request. Vezna uses these connections to read activity; it does not initiate payments.
- AI assistants that users connect themselves — when a user connects ChatGPT (OpenAI) or Claude (Anthropic) to Vezna, the data their assistant requests is processed by that provider under the user’s own agreement with it. See Connect ChatGPT or Claude.
- Services for our website and pages — Vercel hosts the public website vezna.ai (no client books are stored there); Google Fonts and the jsDelivr network serve fonts and a charting library to visitors’ browsers; Cal.com handles call bookings. See the Privacy Policy.
Changes to this list
We tell the owners of each client company by email at least 30 days before we add or replace a sub-processor, and update this page. A client can object as its Data Processing Agreement describes. Questions: support@vezna.ai.