Sub-processors
Who else handles your data
Trisova uses a small number of outside services to run. Each one only gets what it needs, and some are only used if your organisation switches the feature on.
Draft, under legal review
This is a working draft that describes how Trisova works today. It isn't in force yet and may change before it is. Contracts signed before then use the terms attached to them.
The list
| Service | What it does | What it gets | Where | When |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage | All data you keep in Trisova | EU (Ireland) | Always |
| Vercel | Runs the Trisova website and app | Requests passing through, briefly; server logs | EU (Dublin) for the app; pages are cached worldwide | Always |
| Anthropic | AI features (Claude) | Only what an AI feature needs, with names, emails and phone numbers removed where the feature doesn't need them; documents you ask it to read | United States | On unless your organisation switches AI off (Settings → AI governance) |
| Resend | Sends emails "via Trisova" | Recipient email address, the email's content | United States | Only when your organisation chooses to send from Trisova instead of its own mailbox |
| Sentry | Tells us when something breaks | Technical error details, with the personal details we know about (account, cookies, sign-in) removed | EU | Always, once switched on |
| Veridion | Company details for suppliers (size, industry, locations) | Supplier names and websites | EU (to be confirmed) | Only if your organisation uses this enrichment |
| Photon (Komoot) | Address search: turns a typed address into map coordinates | The address text being typed | EU (Germany, to be confirmed) | When someone searches for an address |
| OpenSanctions | Sanctions and politically-exposed-person screening | Supplier and key-person names | EU (Germany) | Only if your organisation uses this screening |
| ComplyAdvantage | Adverse-media screening | Supplier names | UK | Only if your organisation uses this screening |
If your organisation connects its own Microsoft 365 or Google mailbox to send emails, those emails go through your own provider under your own agreement with them; it isn't a Trisova sub-processor. Public registers Trisova reads (company registers, sanctions lists, news and hazard feeds) receive only searches, not your records.
Changes
We'll update this page and tell your organisation's owners by email at least 30 days before adding a new service that handles your data, so you can object. Questions: hello@trisova.com.