Sub-Processor List
Sub-Processors
Last updated: April 6, 2026
This page lists the third-party sub-processors that Plaw, Inc. engages to process data on behalf of customers as described in our Data Processing Addendum. We update this list at least 30 days before engaging a new sub-processor and notify affected customers via email.
Infrastructure Sub-Processors
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Google Cloud Platform (GCP) | Primary cloud infrastructure: compute (Cloud Run), networking, logging (Cloud Logging), secret management | United States (us-central1) | All service data in transit and at rest |
| Convex | Real-time database and serverless backend functions | United States | Organization, project, policy, decision, and approval data |
| Resend | Transactional email delivery | United States | Email addresses, email verification tokens, notification content |
| PostHog | Product analytics (consent-gated only) | European Union (Frankfurt) / United States | Anonymized usage events, pageviews, feature interaction metadata |
| Autumn | Billing, subscription management, and entitlement enforcement | United States | Organization IDs, email, plan tier, usage events |
| Vercel | Documentation site hosting (docs.veto.so) | Global CDN | Request metadata (IP, user agent) for documentation visitors |
| GitHub | Source code hosting, CI/CD pipelines, issue tracking | United States | Source code, build artifacts, deployment metadata |
| Cloudflare | DNS management and DDoS protection | Global | Request metadata (IP, headers) in transit |
Customer-Configured LLM Providers
When customers enable AI-assisted policy features, data may be transmitted to LLM providers based on the customer's configuration. These providers only receive data when the relevant feature is actively used.
| Provider | Location | Note |
|---|---|---|
| SiliconFlow (Qwen, GLM, MiniMax) | Singapore / China | Only when customer enables AI-assisted policy mode |
| Moonshot (Kimi) | China | Only when customer selects this provider |
Change Notification
Per our DPA, we provide at least 30 days advance notice before engaging a new sub-processor. To receive notifications, ensure your account email is current. You may object to a new sub-processor within 14 days of notification by emailing team@plaw.io.