Current list
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase Inc., on Amazon Web Services | Managed database | Frankfurt (eu-central-1) for the Services; Stockholm (eu-north-1) for Veliu’s commercial systems |
| Amazon Web Services EMEA SARL | Serverless functions that route model requests and run assessments; model inference through Amazon Bedrock | Frankfurt (eu-central-1); Bedrock in EU regions |
| Google Cloud EMEA Limited | Background workers and schedulers; model inference through Vertex AI | Belgium (europe-west1) |
| Vercel Inc. | Web hosting and edge network | Frankfurt (fra1) and Stockholm (arn1) |
| Microsoft Ireland Operations Limited | Model inference through Azure OpenAI Service | European Union |
| OpenAI, L.L.C. | Model inference | United States, under the Standard Contractual Clauses |
| Stripe Payments Europe Ltd | Payments and SEPA Direct Debit mandates | Dublin, Ireland |
| PostHog Inc. | Product analytics | EU cloud, Frankfurt |
| Composio | Connections to the third-party services that Customer links to the Brand Agent; the available connectors are listed on the Integrations page at https://veliu.com/legal/integrations | United States, under the Standard Contractual Clauses |
| iubenda s.r.l. | Cookie consent | Milan, Italy |
Subprocessors established outside the European Economic Area, or with access from outside it, rely on the Standard Contractual Clauses or on an adequacy decision, including the EU-US Data Privacy Framework where certified.
Changes
- 31 October 2026: Composio’s purpose updated (connections to the third-party services the customer links); a new subprocessor is now published here when it goes into production, with a notice in the account (Data Processing Agreement, version 1.3).
- 30 October 2026: first publication of this page, with the list in Annex 3 of the Data Processing Agreement, version 1.2.