Subprocessors
To deliver the Ventrace platform, we engage carefully vetted third-party subprocessors for specific infrastructure and data processing tasks. All subprocessors are bound by data processing agreements and meet our security standards.
Our commitment: We vet every subprocessor before onboarding, maintain DPAs with all of them, and review them annually. We will notify you at least 30 days before adding a new subprocessor that handles customer ESG data. To receive notifications, email privacy@ventracehq.com with the subject “Subscribe to Subprocessor Updates”.
1. Overview
A subprocessor is a third-party service provider that processes personal data or customer data on Ventrace’s behalf as part of delivering the platform. This list covers all subprocessors engaged as of the date above.
Where a subprocessor is located outside the EEA or UK, we rely on appropriate safeguards for international data transfers — primarily EU Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs). See our Data Use Policy for more detail.
2. Core Infrastructure
These providers power the hosting, compute, storage, and content delivery infrastructure that underpins the Ventrace platform.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, compute (EC2), database (RDS PostgreSQL), object storage (S3), networking | US, EU (Frankfurt, Ireland) | EU SCCs / AWS DPA |
| Vercel Inc. | Frontend edge compute, CDN, Next.js deployment infrastructure | Global (Edge) / US HQ | EU SCCs |
| Cloudflare Inc. | DNS, DDoS protection, WAF, SSL termination | Global (Edge) / US HQ | EU SCCs |
| Redis Ltd. | Session caching, rate limiting, background job queues | EU (configurable) | EU SCCs |
3. AI & Data Processing
These providers power Ventrace’s AI compliance assistant, document analysis, knowledge base, and intelligent gap analysis features. All operate under zero-retention, no-training API configurations — your data is never used to train or improve their models.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Anthropic, PBC | Large language model inference — Claude models for compliance analysis, document understanding, and AI assistant | United States | EU SCCs / Zero-retention DPA |
| OpenAI, LLC | Supplementary AI features — GPT models for specific analysis tasks | United States | EU SCCs / Zero-retention DPA |
| Chroma (open-source, self-hosted) | Vector database for semantic search and knowledge base RAG workflows — hosted within our own infrastructure, no third-party data transfer | Within Ventrace infrastructure | No transfer (self-hosted) |
4. Communications
These providers handle transactional emails and platform notifications.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Twilio SendGrid | Transactional email delivery — account notifications, alerts, password reset, invite emails | United States | EU SCCs |
5. Payments & Billing
Payment card data is processed directly by our payment provider and never stored on Ventrace servers.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe Inc. | Payment processing, subscription billing, invoicing, and card tokenisation | United States / Ireland (EU) | EU SCCs / PCI DSS Level 1 |
6. Monitoring & Observability
These providers help us maintain platform reliability, monitor for errors, and analyse product usage. Usage analytics data is collected only with user consent and is aggregated and anonymised.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Sentry Inc. | Application error monitoring and crash reporting | United States | EU SCCs |
| PostHog Inc. | Product analytics and feature usage tracking — consent-gated, anonymised | EU (PostHog Cloud EU) | EEA (no transfer required) |
| OpenTelemetry Collector (self-hosted) | Infrastructure metrics, distributed tracing, and application performance monitoring — hosted within our own infrastructure | Within Ventrace infrastructure | No transfer (self-hosted) |
7. Updates & Change Notifications
Before adding any new subprocessor that handles Customer Data or ESG data, Ventrace will provide at least 30 days’ advance notice via email to your organisation’s designated contact.
If you object to a new subprocessor on legitimate data protection grounds, you may raise the objection in writing to privacy@ventracehq.com. If we are unable to resolve your objection, you may terminate your subscription with a pro-rated refund of prepaid fees as provided in our Terms of Service.
To subscribe to subprocessor change notifications, email privacy@ventracehq.com with subject line “Subscribe to Subprocessor Updates”.
This list was last updated on 28 April 2026. The most current version is always available at ventracehq.com/subprocessors.