Sub-processors
Last updated: July 25, 2026
Vellio uses the following third-party processors to operate the Service. This list complements our Privacy Policy.
| Name | Role | Data category | Residency | Lawful basis |
|---|---|---|---|---|
| Vercel | Application hosting, CDN, serverless execution | HTTP requests, session cookies, page views, API traffic metadata | United States (global edge) | Contract — necessary to operate the Service |
| Neon | PostgreSQL database hosting | Account data, prompts, conversations, messages, billing metadata, marketplace data | United States (configurable region) | Contract — necessary to store your data |
| Resend | Transactional email delivery | Email address, verification and account emails | United States | Contract — necessary to deliver account emails |
| Upstash | Redis — rate limiting and ephemeral keys | IP-derived rate-limit keys, captcha replay keys, export download tokens (hashed) | United States / EU (project region) | Legitimate interest — abuse prevention and security |
| Stripe | Payments and subscriptions | Billing email, subscription status, payment method tokens (held by Stripe) | United States / global | Contract — necessary to process payments |
| Cloudflare | Turnstile captcha, DNS, edge security | Signup captcha tokens, IP-derived abuse signals | Global | Legitimate interest — abuse prevention |
| OpenAI | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to OpenAI models | United States | Contract — necessary to generate AI responses you request |
| Anthropic | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Claude models | United States | Contract — necessary to generate AI responses you request |
| Google (Gemini) | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Gemini models | United States / global | Contract — necessary to generate AI responses you request |
| DeepSeek | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to DeepSeek models | China / global API regions | Contract — necessary to generate AI responses you request |
| xAI | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Grok models | United States | Contract — necessary to generate AI responses you request |
| Mistral AI | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Mistral models | European Union / France | Contract — necessary to generate AI responses you request |
| Perplexity AI | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Sonar models | United States | Contract — necessary to generate AI responses you request |
| Groq | AI response generation (BYOK and hosted credits) | Chat messages and prompts sent to Groq-hosted models | United States | Contract — necessary to generate AI responses you request |
| OpenRouter | AI routing gateway (BYOK and hosted credits) | Chat messages routed to underlying model providers per your model selection | United States | Contract — necessary to generate AI responses you request |
| Tavily | Web search queries when Search the web is available in chat | User-initiated search queries derived from prompt text (and model-generated search queries in the tool loop) | United States | Contract — necessary to fetch current web results you request via chat |
| Sentry | Error monitoring and reliability | Scrubbed error events — API keys, tokens, message content, and emails removed per H5 | United States | Legitimate interest — service reliability and security |
| PostHog (EU) | Product analytics and funnel events | Pseudonymous usage events (userId CUID only); PII blocklist per H16 — no email, API keys, prompt text, or folder names | European Union | Legitimate interest — product improvement during soft launch |
| Better Stack | Uptime monitoring and status page | HTTP health-check metadata for public endpoints | European Union | Legitimate interest — availability monitoring |
* Phase 11 introduced Sentry, PostHog, and Better Stack as new sub-processors per Vellio-PRD.md Section 5 paragraph 1. Phase 12 added Tavily for optional web search in chat (queries may contain prompt-derived text; Vellio logs call counts and durations only, never full query text).