Overview

What a subprocessor is, and how we use them.

A subprocessor is a third party that Visneo engages to process personal or business data on our behalf in order to deliver the Service. We use the subprocessors listed below; each is bound by a data-processing agreement and may only use the data to provide its service to us.

Each listed subprocessor is a United States company that stores data in the United States. Some also operate global edge networks — Vercel for content delivery, Cloudflare for DNS and traffic protection — so the metadata they handle there, including request metadata and routed email metadata, may be processed at a point of presence outside the United States. We do not sell customer or end-user data, and we do not transfer it to a subprocessor for that subprocessor's own marketing.

This list covers infrastructure and integration providers common to all customers. A specific connector only receives data once you choose to connect it (for example, Plaid, Intuit, and Google receive data only after you link a bank account, QuickBooks Online company, or Gmail mailbox).

Vendors

Who processes data, and why.

16 providers. Each is a United States company, and a connector only receives data once you choose to connect it.

Supabase

Service: managed PostgreSQL database, authentication, and file storage — Visneo's primary application data store.
Data processed: account profiles and credentials, workspace and store records, and the operational and financial data Visneo stores on your behalf.
Region: United States. Provider: Supabase, Inc.

Vercel

Service: application hosting, serverless compute, and content delivery for the Visneo web app and APIs, plus product analytics and web performance measurement.
Data processed: HTTP request metadata (including IP address and user agent) and any application data transiting the request/response path. Separately, a script in your browser reports page views, visitor counts, approximate location and device type, and page-performance timings for each route — carrying no account identifier and no page query parameters.
Region: compute in the United States; global content-delivery edge network. Provider: Vercel, Inc.

Cloudflare

Service: authoritative DNS, TLS termination for proxied records, DDoS and network protection, and email routing for Visneo addresses.
Data processed: visitor IP address, request metadata, and traffic telemetry; routed email metadata.
Region: United States for account data; global edge network for traffic handling. Provider: Cloudflare, Inc.

DocuSign

Service: electronic signature and delivery of the Terms of Service and Master Services Agreement during onboarding.
Data processed: signer name and email address, signing IP address and timestamp, the signature itself, and the executed agreement document.
Region: United States. Provider: DocuSign, Inc.

Stripe

Service: subscription billing and payment processing for Visneo plans.
Data processed: billing contact details, subscription and plan status, and payment transaction metadata. Card details are entered directly into Stripe and are never received or stored by Visneo.
Region: United States. Provider: Stripe, Inc.

Plaid

Service: secure bank-account linking and retrieval of balances and transactions for the cash-position features.
Data processed: the financial-institution account, balance, and transaction data for accounts you choose to link, plus the credentials you enter into Plaid's own secure flow (Visneo never sees those credentials).
Region: United States. Provider: Plaid Inc.

Intuit (QuickBooks Online)

Service: accounting-system synchronization for the books, invoices, and accounts-receivable features (read-only; Visneo does not write back to QuickBooks).
Data processed: the QuickBooks Online company profile, chart of accounts, invoices and customer references, bills and accounts-payable data, sales receipts, deposits, purchases, and profit-and-loss report data you authorize Visneo to read.
Region: United States. Provider: Intuit Inc.

Google (Gmail)

Service: Google account sign-in and, if you choose to connect your mailbox, the legal-mail scanning feature that surfaces compliance-relevant messages.
Data processed — sign-in (all users who sign in with Google): your Google account identifier and profile email, used only to authenticate you.
Data processed — mailbox connection (only if you connect Gmail): read-only access to recent messages (sender, subject, and body) so Visneo can identify legal and compliance mail. Visneo does not send, modify, or delete mail.
Region: United States. Provider: Google LLC.

Twilio

Service: delivery of SMS alerts (for example, compliance, safety, and urgent operational notifications).
Data processed: recipient phone numbers and the content of the alert messages we send.
Region: United States. Provider: Twilio Inc.

Twilio SendGrid

Service: transactional and account email delivery (for example, sign-in, invitations, and notifications).
Data processed: recipient email addresses and the content of the emails we send.
Region: United States. Provider: Twilio Inc. (SendGrid).

OneSignal

Service: web push notifications to browsers that opt in.
Data processed: push-subscription identifiers and basic device/browser metadata, plus the content of the notifications.
Region: United States. Provider: OneSignal, Inc.

Anthropic

Service: the large-language-model analysis behind Visneo's recommendations, summaries, and briefings.
Data processed: the business and operational data Visneo submits for a given analysis, including documents and images you upload for processing (for example, register-close reports), which may incidentally include personal names appearing in your records. Under Anthropic's commercial API terms, this data is not used to train their models.
Region: United States. Provider: Anthropic, PBC.

Sentry

Service: application error monitoring, performance tracing, and session replay used to detect and debug faults in the Service.
Data processed: error reports and stack traces, which by configuration include request metadata (such as IP address, user agent, and request headers) and server-side variable snapshots present at the time of an error, plus sampled session replays (recordings of in-app browser sessions with text and input fields masked).
Region: United States. Provider: Functional Software, Inc. (Sentry).

Axiom

Service: application logging and observability used to operate and debug the Service.
Data processed: application and event logs, which may incidentally include identifiers and request metadata.
Region: United States. Provider: Axiom, Inc.

Inngest

Service: orchestration of Visneo's background jobs and scheduled workflows.
Data processed: the event payloads for those workflows, which carry the operational data a given job acts on.
Region: United States. Provider: Inngest, Inc.

Slack

Service: internal delivery of product feedback and feature requests submitted from within the application.
Data processed: the text of the request you submit and the identity of the submitting user. No financial, POS, or accounting data is sent.
Region: United States. Provider: Slack Technologies, LLC (Salesforce, Inc.).

Changes

Changes to this List.

We update this list when we add or remove a subprocessor. Material changes are also reflected in our Privacy Policy. Where a customer agreement requires advance notice of a new subprocessor, we provide it as set out in that agreement.

Contact

Questions about our subprocessors can be sent to privacy@visneo.ai or by mail to Visneo, Inc., 2901 W Armitage Ave, Chicago, IL 60647.

This page mirrors the subprocessor list in the Visneo dashboard, which is the version customers agree to. If the two ever differ, the dashboard copy is authoritative.

Subprocessors