Sub-processors
Governli sub-processors
This page is maintained by the Governli team and lists the third parties Governli relies on to deliver its vendor due diligence platform. It is provided so customer procurement and security teams can complete their fourth-party assessment.
| Sub-processor | Purpose | Data categories | Region |
|---|---|---|---|
| Vercel Inc. | Application hosting and delivery of the Governli web application. | Requests and responses for the web application; no persistent customer content store. | EU region (primary); global CDN edge for static assets |
| Supabase Inc. | Managed PostgreSQL database, authentication and file storage — the primary persistent data store. | Customer and supplier account data, assessment data, uploaded evidence files. | EU (primary database region) |
| Stripe Payments Europe, Ltd. | Payment processing, checkout, tax calculation and invoicing for purchases and subscriptions. Governli never receives full card numbers. | Billing contact, billing address, tax identifiers, payment method metadata, invoice records. | EU / Ireland (with Stripe's global processing per its own terms) |
| Resend (Plus Five Five, Inc.) | Transactional email delivery: invitations, notifications and support emails to customers and suppliers. | Recipient email address, sender, subject and message body. | Per provider configuration |
| Sentry (Functional Software, Inc.) | Error monitoring and operational telemetry for the application. | Error events and technical context; no uploaded document content. | EU (Sentry EU data residency) |
| OpenAI, LLC | AI analysis of uploaded evidence against assessment requirements. Customer data is never used to train models. | Evidence extracts and requirement text submitted for a single analysis request. | United States (OpenAI API). No EU residency is configured for the AI analysis path; transfers rely on the safeguards described in the DPA. |
Change management
- New sub-processors are evaluated against our security-review process before being added.
- Material changes to this list are announced by email to account administrators, with a reasonable objection window.
- Contractual obligations relating to security and privacy are flowed down to every sub-processor.
Related pages
- • Data Processing Agreement — GDPR-aligned DPA scope and how to request it.
- • Security & privacy — encryption, residency, retention and compliance posture.
- • AI Transparency — model providers and how AI is used.