- Version
- 2026-07-27
- Last updated
This register identifies Verbrio's service providers, the information they handle and their roles. Provider use and processing arrangements vary by project.
Read this register by role
A provider's role depends on the data and service involved. A company processing customer personal data for Verbrio may be a subprocessor. A customer-selected integration, an external booking service and an engineering tool can have different relationships.
Not every listed provider is used on every project. The project processing arrangements must identify the providers involved and their roles.
A subprocessor is a supplier that Verbrio engages to process customer personal data while Verbrio acts as the customer’s processor. We remain responsible for selecting, contracting, and overseeing those suppliers as required by our DPA.
Not every company named here has the same role. Customer-selected integrations and engineering tools are separated from production subprocessors so their status is clear.
Project delivery providers
The existing register lists Scaleway for infrastructure, Cloudflare for network and security, Lettermint for email, Mistral AI for document processing, Jina AI for search, PostHog for analytics and APIStax for VAT validation. The table records those stated functions without assuming they apply to a new engagement.
These providers support the service today. We limit the data shared with each provider to what the relevant function requires.
Service providers · Use varies by project
| Provider | Listed function | Data involved |
|---|---|---|
| Scaleway S.A.S.Cloud infrastructure and storageProcessing location: France (Paris region) for core infrastructure.Status: Current | Infrastructure & storage Host the application, databases, files, and encrypted backups needed to operate Verbrio. | Hosted records and files Account, workspace, contact, document, order, invoice, integration, and technical data stored by the service. |
| Cloudflare, Inc.Network, DNS, security, and content deliveryProcessing location: Provider-operated global regions; international transfers may occur under applicable safeguards.Status: Current | Network & security Provide DNS and, where proxying is enabled, route and protect web traffic, terminate TLS, mitigate abuse, and deliver content. | Traffic and request information IP addresses, request headers, security and traffic metadata, and content transiting the proxy where required. |
| Lettermint B.V.Transactional emailProcessing location: Primarily the Netherlands, with backups in Germany.Status: Current | Transactional email Deliver outbound service messages and receive inbound messages used by connected workflows. | Messages and delivery details Sender and recipient details, subject, HTML or text body, attachments, template variables, routing and authentication headers, delivery events, and spam or authentication results. |
| Mistral AIAI document processingProcessing location: EU-hosted by default; limited temporary non-EU transfers may occur under applicable safeguards.Status: Current | Document processing Provide OCR and AI-assisted features that extract, classify, structure, translate, or reason over information selected by the customer. | Selected documents and context Selected files and full document content, extracted text and fields, chat or tool context, product-import data, marketplace messages, translations, addresses, VAT and business details, and task instructions. |
| Jina AI GmbH (an Elastic company)Search, retrieval, and document understandingProcessing location: Provider-operated regions; international transfers may occur under applicable safeguards.Status: Current | Search & retrieval Create semantic representations and rerank extracted document text and search queries to support document search. | Document text and search queries Document text, search queries, extracted fields, embeddings, and related technical metadata. |
| PostHog, Inc.Product analyticsProcessing location: EU Cloud endpoint; provider support or access may involve safeguarded international transfers.Status: Current | Analytics Understand product use, diagnose issues, and improve the service. Marketing analytics is enabled only after consent. | Usage and diagnostic information Usage events, page and feature interactions, account or workspace identifiers, order, order-item, ticket, invoice and fulfilment identifiers, device data, IP-derived data, and diagnostic metadata. |
| APIStax (instant:solutions OG)Business and tax data APIsProcessing location: Operated from Austria; provider-operated hosting regions may apply.Status: Current | VAT validation Validate VAT identifiers requested through Verbrio. | VAT identifiers and registry results VAT identifier and returned registry details such as validity, registered name, address, and country. |
| Polar Software, Inc.Billing and merchant of recordProcessing location: United States and global payment infrastructure; international transfers occur under applicable safeguards.Status: Current | Act as Verbrio's processor when administering subscriptions on our instructions. At checkout, Polar also operates payment, tax, and invoicing as merchant of record and a separate controller for purposes it determines. | Customer and administrator identity, company and billing details, subscription and transaction metadata; payment credentials are handled by Polar and its payment providers, not stored by Verbrio. |
| Expo / EAS Update (650 Industries, Inc.)Native application delivery and updatesProcessing location: Provider-operated global regions; international transfers may occur under applicable safeguards.Status: Current | Build and deliver native application updates through Expo Application Services for the production native app. | Device and application identifiers, update tokens, IP address, update and build metadata, and delivery or activity logs. |
EU-established providers
Scaleway, Lettermint, Mistral AI, Jina AI, APIStax
The listed legal entities of these providers are established in the EU. That alone does not mean every processing operation stays in the EU; see each provider’s processing location.
Providers established outside the EU
Cloudflare, PostHog, Polar, Expo / EAS Update
The listed legal entities of these providers are established outside the EU. Where their use involves a restricted transfer, Verbrio relies on the applicable safeguards described below.
Billing and application delivery
The register also lists Polar for subscription administration and Expo for native application delivery. The project quote identifies its applicable billing and delivery arrangements.
Founder booking opens Google Calendar externally. Its own privacy information applies to information submitted through that booking service.
Customer-selected connections
Connections such as Refurbed, Back Market or WeFact can operate under the customer's own agreement with that service. They are not automatically Verbrio subprocessors. The scope should identify who selects the connection, controls access and authorises the exchange.
Refurbed, Back Market, WeFact, and similar connected services are enabled and controlled by the customer under the customer’s own agreement with that service. They are therefore not automatically Verbrio subprocessors.
Verbrio processes data imported from or sent to those services on the customer’s instructions. The customer is responsible for choosing the integration, configuring access, and having a lawful basis for the exchange.
Engineering and evaluated alternatives
The existing register identifies Cursor, OpenAI Codex and Anthropic Claude Code as engineering tools, separately from production subprocessors. That distinction must remain clear when reviewing actual project access.
Providers considered for future use do not belong in the engaged provider list until their use is confirmed.
Our engineers use Cursor, OpenAI Codex, and Anthropic Claude Code to help write and review code. We do not classify them as production subprocessors because our policy prohibits intentionally submitting production customer data, credentials, or secrets to these tools.
We use contracted business or privacy modes intended to prevent model training on submitted content and to minimize retention. We only describe a tool as having zero data retention when that protection is expressly supported and enabled for the account in use.
If we intend to let an engineering tool process production customer data, we will first assess it, contract it as required, and add it to the current subprocessor list before that use begins.
This is a non-binding direction of travel, not a notice that a migration has happened.
We are evaluating Bunny.net as a possible replacement for Cloudflare. Cloudflare remains the current provider until a migration is completed and announced.
We are investigating Wero and the payment service provider required for a possible future payment stack. Polar remains the current billing and merchant-of-record provider until a completed migration is announced.
Locations and changes
Processing locations and relevant transfer arrangements must be recorded for each provider and delivery setup. Registration in Europe does not establish that all processing remains there. Provider-change notices and concerns follow the applicable DPA.
We prefer processing in the European Economic Area. Where a provider processes data outside it, we require an applicable adequacy decision or contractual safeguards such as the European Commission’s standard contractual clauses, plus supplementary measures where the assessment requires them.
Processing locations can change within a provider’s contracted service. Material changes to the production subprocessor chain are handled through the notice process below.
We keep this page current and, under our DPA, give customers at least 30 days’ advance email notice before authorizing a new production subprocessor or replacing one, unless urgent security or legal circumstances make advance notice impossible.
A customer may object during that period on reasonable data-protection grounds. We will review the concern in good faith and seek a reasonable alternative; if none is available, either party may end the affected service as described in the DPA.
Questions or objections
Contact Verbrio B.V. at the address below. Include your organization name, the affected provider, and the data-protection reason for an objection.
Hoedemakerplein 2
7511 JP Enschede
The NetherlandsKvK 96023325
VAT NL867435276B01