Sub-processors
VAERG uses a small number of carefully selected service providers to deliver the screening service. Each provider processes data only for the purpose stated below, under a data processing agreement that meets the requirements of Article 28 GDPR, and none of them is permitted to use customer content to train AI models.
01Current sub-processors
| SUB-PROCESSOR | PURPOSE | DATA PROCESSED | LOCATION | TRANSFER SAFEGUARD |
|---|---|---|---|---|
| Railway Corp. | Application hosting and processing pipeline. Uploaded materials exist here only during processing and are deleted on report generation; archived reports are stored here | Uploaded deal materials (during processing only), generated reports, job metadata | EU (Amsterdam, Netherlands) | Processing within the EU; provider DPA with SCCs for any residual access from the US |
| Anthropic, PBC | AI analysis of extracted deal content (Claude API, commercial tier) | Extracted text and data from uploaded materials, analysis outputs | United States / global infrastructure | EU Standard Contractual Clauses (2021) in Anthropic's Data Processing Addendum; no training on API data |
| Google (Google Ireland Ltd / Google LLC) | Document text and data extraction (Gemini API, paid commercial tier) | Uploaded PDF documents during extraction | United States / global infrastructure | EU Standard Contractual Clauses in Google's data processing terms; paid-tier content is not used to improve Google's products |
| Vercel Inc. | Delivery of the vaerg.com website | Website visitor data only. Uploaded deal materials are transmitted directly from your browser to the EU processing environment and do not pass through Vercel | United States / global CDN | EU Standard Contractual Clauses in Vercel's DPA |
| Resend (Plus Five Five, Inc.) | Transactional e-mail (order confirmations, delivery notifications) | Recipient name and e-mail address, notification content. Reports are retrieved by secure download link | United States | EU Standard Contractual Clauses in Resend's DPA |
02AI providers and training
VAERG uses only commercial API tiers of its AI providers. Under those terms, neither Anthropic nor Google uses VAERG customer content to train or improve their models. VAERG never uses customer content to train models of its own, and content from one customer is never used in the analysis of another.
03Data residency
Storage and orchestration of customer materials take place in the EU. AI inference is currently performed on US-based provider infrastructure under the safeguards above. An EU-resident inference option, via EU-region cloud deployments of the same models, is on VAERG's roadmap for customers with strict residency requirements.
04Verification
Provider terms and certifications change over time. The transfer safeguards above reflect the providers' published data processing terms as at the date of last update; verify current status at each provider's trust page, or request VAERG's latest transfer impact summary at contact@vaerg.com.