arveoSubprocessor and Integration Register
Last updated: September 11, 2026
Status: Prelaunch register; account-specific contracts, regions, and retention require confirmation before customer onboarding.
Contact: privacy@arveo.ai
Core Services
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, private object storage | Profiles, accounting records, conversations, documents, encrypted integration credentials, authentication records |
| Vercel | Application hosting and execution | Requests and the customer data processed by application functions, plus operational logs |
| Anthropic | AI inference | Requested accounting context, transactions, conversations, knowledge, and complete PDFs/images for document tasks; incidental personal information can be present |
| Upstash | Distributed rate limiting | Rate-limit identifiers derived from requests, IP addresses or user identifiers, and counters |
| Resend | Inbound and outbound email | Addresses, message bodies, financial context, requests, and attachments |
| Sentry, when configured | Minimal error monitoring | Allowlisted technical error metadata; application request bodies, exception text, replay, and traces are excluded by the current application configuration |
| Stripe | Billing | Subscription/customer identifiers and billing records; card entry and raw payment-card storage are handled by Stripe |
Optional Connected Services
| Provider | When used | Data involved |
|---|---|---|
| Intuit / QuickBooks Online | Connected accounting workflows | Accounting records, financial reports, and approved write requests. Arveo stores encrypted access and refresh tokens; the accounting OAuth scope is not read-only |
| Plaid | Linked bank accounts | Account identifiers, balances, transactions, connection status, and access-token processing |
| Pipedream | Enabled connected-application workflows | Authorized application connections, credentials managed by the provider, and selected workflow payloads |
| Slack / Salesforce | Enabled messaging and agent workflows | Financial questions, replies, notifications, workspace/channel identifiers, and integration tokens; not limited to internal operational alerts |
| Twilio | Enabled SMS, WhatsApp, and voice workflows | Phone numbers, message contents, attachments, authentication messages, and call data |
| Retell | When selected as the voice provider | Call audio/transcripts, caller identifiers, configured agent context, and tool results |
| ServiceTitan | Enabled home-services integration | Authorized job, customer, technician, and work-order records |
| Customer-approved connected applications | When explicitly connected | The information needed for that integration and workflow, as agreed before activation |
Operational Services
GitHub hosts source code and CI. Customer records and credentials must not be committed. Cloudflare may provide DNS/edge services where configured. These services require an operational vendor assessment; their presence in source configuration does not prove a particular production account or data region is active.
Document malware scanning uses a ClamAV service behind authenticated TLS. A hosting vendor for that service must be recorded and approved before deployment. Customer document contents are streamed to the configured scanner.
Data Handling and Location
Provider headquarters do not establish processing location. Actual hosting regions, subprocessors, international transfers, backup locations, inference retention, and support access depend on the contracted plan and settings. Request the account-specific register and DPA before onboarding. Arveo does not promise universal US-only or India-only processing.
Customer-derived promotion to shared industry/global AI knowledge is disabled. Customer content can still be processed by the providers needed for the customer's enabled workflows. Automated filtering does not guarantee documents or messages contain no personal information.
Changes
Before a new provider processes customer data, the firm must complete vendor approval, update this register, and provide the notices required by the applicable customer agreement and law. Optional integrations remain disabled until their configuration and approvals are complete.
For processing, transfer, retention, or objection requests, contact privacy@arveo.ai. See the Privacy Policy.