How to read this list
A sub-processor is a third party engaged by Coordentra Kft. that may process personal data contained in customer data while providing part of the Vetoo service. This page lists them by category, together with the entity we contract with, its role, where processing takes place, and the mechanism that covers any transfer outside the European Economic Area (EU-U.S. Data Privacy Framework certification or the European Commission’s Standard Contractual Clauses, SCC).
Changes to this list take effect on the date shown at the top of the page and every earlier version stays readable in the version history below. Customers who have concluded our Data Processing Agreement are notified of intended additions or replacements at least 30 days in advance, as set out in that agreement, and may object as described there.
None of the AI model providers listed here uses customer content to train models; source code is processed only for the duration of a review and is not retained by us.
Infrastructure and hosting
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services (AWS EMEA SARL) | Cloud infrastructure: application hosting, databases, data storage, and sending and receiving email | EU (Ireland, eu-west-1); AWS commits to keep customer data in the selected region | EU processing; SCC for any transfer |
AI model providers
During a review, the code change and the context it needs are sent to model providers for inference only. Which providers are involved depends on the configuration of the service; under an Enterprise bring-your-own-key arrangement the customer’s own key is used instead of ours.
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services, Amazon Bedrock (AWS EMEA SARL) | Model inference for the service; customer content is not used to train models | EU (EU inference profiles) | EU processing; SCC for any transfer |
| OpenAI Ireland Ltd. | Model inference for the service; customer content is not used to train models | EU contracting entity; processing may occur in the USA | SCC |
| Google (Gemini API, paid tier) | Model inference for the service; customer content is not used to train models | USA and EU | SCC, or Google’s adopted transfer solution |
| Swarmnet Solutions Pte. Ltd. (Novita AI) | Model inference for the service; customer content is not used to train models | Singapore contracting entity; processing primarily in the USA | SCC |
| Anthropic Ireland, Ltd. (bring-your-own-key only) | Model inference for the service; customer content is not used to train models | EU contracting entity | Per Anthropic’s Data Processing Addendum, incorporated into its Commercial Terms |
Identity, payments and invoicing
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Clerk, Inc. | Sign-in, user and organization management (EU representative: VeraSafe Ireland Ltd.) | USA and EU (Google Cloud, Cloudflare) | EU-U.S. Data Privacy Framework, SCC as fallback |
| Stripe Payments Europe, Limited | Payment processing, subscription lifecycle, tax calculation; card data never reaches Vetoo | EU contracting entity; processing in the USA by Stripe, LLC | EU-U.S. Data Privacy Framework, SCC as fallback |
| Billingo Technologies Zrt. | Invoicing and Hungarian tax authority (NAV) reporting | Hungary | EU processing |
Monitoring and analytics
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Datadog, Inc. | Application logging, tracing and performance monitoring, browser performance telemetry after cookie consent | EU (Frankfurt, datadoghq.eu); transfers to the USA possible | SCC |
| PostHog Inc. | Product analytics and session recording after cookie consent, pseudonymised server-side telemetry | EU data centre storage (Frankfurt); processing in the USA by PostHog and its sub-processors | EU-U.S. Data Privacy Framework and SCC |
Support and corporate tooling
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Linear Orbit, Inc. | Customer support ticketing, including ticket attachments | USA (hosted on Google Cloud) | SCC |
| Google (Google Workspace) | Corporate email and document management | USA and EU | SCC, or Google’s adopted transfer solution |
| Slack Technologies Limited (Salesforce group) | Internal operational notifications for our own team | USA | Salesforce Processor Binding Corporate Rules and SCC |
Services you connect yourself
GitHub and GitLab, and the optional context integrations (Slack, Notion, Jira and Linear workspaces connected by a customer), are not our sub-processors. Vetoo reads from them on your behalf under the access you grant when you install the GitHub App, authorise the GitLab connection, or enable an integration, and your own agreement with that provider governs its processing. Removing the installation or integration ends our access.
Questions about this list: privacy@vetoo.dev.
Version history
- 2026-09-02in force