Auvra Labs

Subprocessors

Auvra uses the providers below to host the product, secure accounts, monitor errors, and support approved AI, billing, and email workflows.

Version subprocessors_2026-08-11_v2 - published 2026-08-11.

Vercel

United States

Application hosting

Hosts the web application and serverless routes. No client outreach is executed by Vercel.

account metadata, workspace metadata, application logs

Active
Supabase

United States, current project region

Database and authentication

Stores tenant data with row-level security and powers authentication.

account data, workspace data, database records, authentication data

Active
Sentry

Vendor-managed locations

Error monitoring

Receives scrubbed error and performance telemetry; secrets and unnecessary personal data are not intentionally included.

scrubbed error metadata, route context, release metadata

Active
OpenAI

Vendor-managed model infrastructure

AI inference

Used only behind provider gates for approved AI tasks such as OCR and structured analysis.

prompt inputs, structured outputs, business-card image content when OCR is enabled

Optional
Stripe

Vendor-managed regions

Billing

Conditional billing and payment recipient for Auvra's own billing records when selected as the payment method; not authorized to receive client prospect or contact data.

billing contact data, contract billing records, payment metadata

Planned
Resend

Vendor-managed regions

Transactional email

Conditional transactional and system email provider; processes client personal data only where the applicable lane and DPA notice authorize it.

email addresses, transactional email content

Planned

How Auvra limits provider use

Optional AI, billing, and email providers are not blanket access to client data. They are routed through workspace settings, provider gates, usage ceilings, and review queues. External outreach and destructive actions still require explicit human approval. Additional external parties that process client personal data for a specific engagement are disclosed to that client under the Data Processing Agreement before use.