Sub-Processors
Alverik uses the following third-party services to deliver our platform. Each sub-processor has been evaluated for data protection practices.
| Service | Purpose | DPA Status |
|---|---|---|
| Supabase | Database & Authentication | In Progress |
| Stripe | Payment Processing | Standard DPA |
| Anthropic | AI Draft Generation | In Progress |
| Resend | Transactional Email | Standard DPA |
| Vercel | Application Hosting & Analytics | Standard DPA |
| Google LLC | Authentication (Google OAuth); Google Workspace / Gmail destination inbox for privacy@alverik.ca DSAR intake mail | Standard DPA |
| Cloudflare, Inc. | DNS, web-application security, and Email Routing for the privacy@alverik.ca DSAR intake address | In Progress |
| Railway | Background worker hosting (ingestion, drafting, profile extraction, scheduled jobs) | In Progress |
Supabase
Database & Authentication
- Data:
- Account data, company profiles, drafts
- Location:
- Canada
Stripe
Payment Processing
- Data:
- Billing data, subscription status
- Location:
- United States
Anthropic
AI Draft Generation
- Data:
- Company profile data, opportunity details
- Location:
- United States
Resend
Transactional Email
- Data:
- Email addresses, email content
- Location:
- United States
Vercel
Application Hosting & Analytics
- Data:
- Usage data, IP addresses
- Location:
- Global (Edge)
Google LLC
Authentication (Google OAuth); Google Workspace / Gmail destination inbox for privacy@alverik.ca DSAR intake mail
- Data:
- Email address, profile name, profile picture URL, Google account ID; for DSAR intake: subject identity-verification details and rights-request content contained in inbound DSAR email
- Location:
- United States
Cloudflare, Inc.
DNS, web-application security, and Email Routing for the privacy@alverik.ca DSAR intake address
- Data:
- Inbound DSAR email envelope + body in transit (forwarded to the Google Workspace destination inbox identified above); subject identity-verification details and rights-request content contained in inbound DSAR email
- Location:
- United States (global edge with Canadian POPs)
Railway
Background worker hosting (ingestion, drafting, profile extraction, scheduled jobs)
- Data:
- Company profile data, opportunity details, draft content, user identifiers; processed for the purpose listed. Primary database is hosted in Canada at rest.
- Location:
- United States (us-west2)
Cross-border disclosure (PIPEDA, Quebec Law 25): Several sub-processors listed above process data outside Canada. Specifically: Google LLC processes authentication data on servers located in the United States; Stripe processes billing and payment-related data on US servers; Resend processes email delivery data on US servers; Anthropic processes AI prompts and generated content on US servers; Railway processes background-job data on US servers (us-west2); and Vercel may process app traffic and edge-delivery data through global edge infrastructure, including outside Canada. Railway hosts our background workers (us-west2), which means company profile data, opportunity details, draft content, and associated user identifiers pass through servers located in the United States during ingestion, AI generation, and scheduled jobs. Alverik’s primary database is hosted in Canada at rest through Supabase, while selected processing by named sub-processors may occur outside Canada.
AI and background-worker features that depend on this cross-border processing are available only after you grant express consent during onboarding. Until that consent is recorded, those features remain disabled at the server side. We publish the current DPA status for each sub-processor in the table above; where a DPA is marked “In Progress,” it should not be treated as completed.
To ask questions, discuss alternatives, or withdraw consent where withdrawal is available, contact privacy@alverik.ca.
Last updated: May 2026. Changes to our sub-processors will be communicated via email to all active subscribers at least 30 days in advance.
See also our Privacy Policy for full details on how we handle your data.