The vendors that touch your data.
Arveo uses carefully vetted sub-processors to deliver its platform. Each vendor below has a DPA in place and processes only the minimum data necessary. We notify customers at least 30 days before adding any new sub-processor.
Every vendor, purpose, and data scope — transparent.
| Sub-processor | Purpose | Data shared | Location | Trust page |
|---|---|---|---|---|
| Anthropic | AI inference for transaction categorization and summarization | Transaction memos, amounts, merchant names, category labels | United States | Visit |
| Cloudflare | CDN, DDoS mitigation, and DNS | Anonymized request metadata, IP addresses | Global | Visit |
| fal.ai | AI media inference for generative features | User-provided content in API payloads | United States | Visit |
| GitHub | Source code repository and CI/CD | Application source code, no customer data | United States | Visit |
| Intuit / QuickBooks Online | Source-of-truth financial data platform | Encrypted OAuth refresh tokens (Intuit holds financial records) | United States | Visit |
| Resend | Transactional email delivery | Recipient email addresses, email message body | United States | Visit |
| Sentry | Application error monitoring and performance tracking | Stack traces, error metadata, performance metrics | United States | Visit |
| ServiceTitan | Home-services integration for job records and work orders | Customer names, contact info, job records (scoped to tenants with active integration) | United States | Visit |
| Slack (Salesforce) | Internal team messaging and operational alerts | Operational notification payloads (error metadata, status alerts) | United States | Visit |
| Supabase | Managed Postgres database, authentication, and object storage | Customer PII, financial transaction records, encrypted OAuth tokens | United States | Visit |
| Twilio | SMS and WhatsApp delivery for alerts and OTP | Recipient phone numbers, message body content | United States | Visit |
| Vercel | Application hosting, serverless functions, and edge network | Server-side request logs (IP, user-agent, request paths) | United States | Visit |
We review our sub-processor list at least annually and update this table when the active vendor set changes.
30-day advance notice, every time.
Email notification
When we add a new sub-processor, we send an email to the primary account holder for every affected customer at least 30 days before the new sub-processor begins processing data.
Right to object
Customers who object to a new sub-processor may contact privacy@arveo.ai within the 30-day window. We will work with you to find a resolution, which may include data isolation or processing without the proposed vendor.
Removed sub-processors
No sub-processors have been removed to date. When a vendor is removed, it will be listed here with the date and reason.
Need a DPA or have data processing questions?
Our privacy team responds within one business day.