White Label Consultancy AS engages the sub-processors below to deliver Pritect Veil. This list is complete. If a sub-processor is not on it, it does not process customer personal data for this product.
Every entry is bound by a written agreement imposing data protection obligations no less protective than those in our own Data Processing Agreement.
1Current sub-processors
The processing locations below are the regions we have pinned, not the provider's global footprint. Where a provider is headquartered outside the European Economic Area, the processing itself still takes place in the region named.
| Sub-processor | Service | Purpose | Processing location |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication, object storage | The application database holding cases, entity registries and audit records; account authentication and sessions; private object storage for uploaded source documents and generated bundles | Frankfurt, EU |
| Fly.io (Fly.io, Inc.) | Document processing workers | The containerised service that extracts, detects, redacts, renders, verifies and packages documents. This is the only component that handles document content | Frankfurt and Amsterdam, EU |
| Vercel (Vercel Inc.) | Web application hosting | Hosting and delivery of the Pritect Veil web application. Server functions are pinned to Frankfurt | Frankfurt, EU |
| Mistral AI (Mistral AI SAS) | Large language model and optical character recognition | Entity detection over document text, the adversarial residual pass, and OCR of scanned pages. Called only from the processing worker, never from the browser | France, EU |
| Stripe (Stripe Payments Europe, Ltd.) | Billing and payments | Subscription management, metered usage billing and payment processing. Receives account and billing contact data only, and never receives document content | Ireland, EU |
1.1What each one can see
Supabase, Fly.io and Mistral AI can technically process the content of documents you upload, because processing that content is what they are there for. Vercel serves the application and never receives document content. Stripe receives billing data only.
Personal data that is dense in identifiers, specifically the surface text of detected entities and the normalised document model, is encrypted by the worker before it is written, using a key held per case. A sub-processor holding that data at rest holds ciphertext.
2International transfers
2.1
All processing of customer personal data takes place within the European Union. We do not transfer customer personal data outside the European Economic Area in the ordinary course of providing the service.
Some sub-processors are incorporated outside the EEA even though the processing runs inside it. Where a corporate structure creates the possibility of access from a third country, that access is governed by the European Commission's Standard Contractual Clauses together with supplementary technical measures, principally the encryption described in clause 1.1. A copy of the safeguards in place is available on request.
3Changes to this list
3.1
We will give customers at least thirty days' written notice before adding or replacing a sub-processor, so that there is time to object before the change takes effect.
A customer may object on reasonable data protection grounds within that period. If we cannot offer a workable alternative, the customer may terminate the affected subscription without penalty and receive a pro rata refund of prepaid fees.
3.2
To receive notice of changes, subscribe by writing to privacy@pritect.ai with the subject line "Sub-processor notifications".
Questions about this document
Write to legal@pritect.ai, or to privacy@pritect.ai for anything about personal data. White Label Consultancy AS, Fjordalleen 16, 0250 Oslo, Norway.