Sub-processors
Updated 2026-05-27. We notify Team and Enterprise customers at least 30 days before adding a new sub-processor.
Ovriven is a SaaS product. The third parties below process customer data on our behalf under written DPAs that flow through to your account. Each entry lists the processor, the purpose we use them for, the data category they touch, and the privacy policy URL.
| Processor | Purpose | Data handled | Location | Privacy policy |
|---|---|---|---|---|
| OpenAI | LLM provider — agent reasoning, narrative composition, citations | Stimulus prompts, attachment excerpts, per-agent reasoning context. Outputs are never used to train OpenAI models (zero-data-retention is enabled on the API tier). | United States | Read → |
| Stripe | Billing — checkout, subscription state, customer portal | Billing email, payment method (held by Stripe, not us), subscription state. Card numbers never touch our servers. | United States / EU | Read → |
| Amazon Web Services | Compute, S3 object storage, RDS Postgres | All persisted run data, replay frames, uploads. Encrypted at rest (AES-256) and in transit (TLS 1.2+). | United States (us-east-1 / us-west-2) | Read → |
| Cloudflare | Edge CDN + DDoS protection | HTTP request metadata (IP, headers). Application traffic is TLS-terminated at Cloudflare; the origin sees the user IP via standard forwarding headers. | Global edge | Read → |
| Optional Google sign-in + optional Drive export | Verified email + display name (sign-in); user-chosen Drive file (Export to Drive flow). Only invoked when the user explicitly opts in. | United States / Global | Read → | |
| SendGrid (or Postmark, AWS SES — operator-selected) | Transactional email — signup verification, password reset, notifications | Recipient email + the body of each email. No marketing email is sent without an explicit opt-in. | United States | Read → |
Notification + objection
Team and Enterprise customers can subscribe to sub-processor change notifications by emailing security@ovriven.com. If you have a justified reason to object to a new sub-processor we propose, contact us within the 30-day notification window so we can discuss alternative arrangements.