Sub-Processor List
Sub-Processors
Last updated: May 19, 2026
This page lists the third-party sub-processors that Veto, operated by Plaw, Inc., engages to process data on behalf of customers as described in our Data Processing Addendum. We update this list at least 30 days before engaging a new sub-processor and notify affected customers via email.
Infrastructure Sub-Processors
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Google Cloud Platform (GCP) | Primary cloud infrastructure: compute (Cloud Run), networking, logging (Cloud Logging), secret management | United States (us-central1) | All service data in transit and at rest |
| Convex | Real-time database and serverless backend functions | United States | Organization, project, policy, decision, and approval data |
| Resend | Transactional email delivery | United States | Email addresses, email verification tokens, notification content |
| PostHog | Product analytics (consent-gated only) | European Union (Frankfurt) and United States | Anonymized usage events, pageviews, feature interaction metadata |
| Autumn | Billing, subscription management, and entitlement enforcement | United States | Organization IDs, email, plan tier, usage events |
| Vercel | Static documentation and marketing page hosting | Global CDN | Request metadata (IP, user agent) for site visitors |
| GitHub | Source code hosting, CI/CD pipelines, issue tracking | United States | Source code, build artifacts, deployment metadata |
| Cloudflare | DNS management and DDoS protection | Global | Request metadata (IP, headers) in transit |
Customer-Configured LLM Providers
When customers enable AI-assisted policy features, data may be transmitted to LLM providers based on the customer's configuration. These providers only receive data when the relevant feature is actively used.
| Provider | Location | Note |
|---|---|---|
| SiliconFlow | Singapore and China | Only when customer enables AI-assisted policy mode |
| Moonshot (Kimi) | China | Only when customer selects this provider |
Change Notification
Per our DPA, we provide at least 30 days advance notice before engaging a new sub-processor. To receive notifications, ensure your account email is current. You may object to a new sub-processor within 14 days of notification by emailing team@veto.so.