Provider register
The active provider set depends on the workspace and deployment configuration. A provider is used only when the related service is enabled. Legal entities, regions and transfer safeguards are stated as verified on 2026-09-14 where the row states them; the other rows are listed as configured.
- Supabase — managed PostgreSQL database for application data (Supabase Pte. Ltd., Singapore); the project is hosted in the eu-west-1 region (Ireland), so application data is stored in the EU; support and logs may involve access from outside the EEA under Supabase's DPA (EU Standard Contractual Clauses).
- Vercel — application hosting and serverless functions (Vercel Inc., USA); the functions run in the dub1 region (Dublin, Ireland), edge delivery and platform operations are global; transfers under Vercel's DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework). Vercel also provides Vercel Web Analytics for the public pages: cookieless, aggregated visit statistics (no custom events, no user identifiers, no query strings).
- OpenAI — AI text features in the panel, when enabled for a workspace (OpenAI Ireland Ltd, Ireland, as our contracting party); processing may take place outside the EEA under OpenAI's DPA (EU Standard Contractual Clauses).
- ElevenLabs — AI voice agent (speech recognition, language model and speech synthesis), when a workspace enables the voice receptionist (Eleven Labs Inc., USA); it uses Google Gemini models as its language-model provider; transfers under ElevenLabs' DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
- Twilio — telephone numbers, call routing and SMS, when a workspace enables telephony (Twilio Ireland Limited as our contracting party, with Twilio Inc., USA); the service runs in Twilio's US1 region, so call and message data is processed in the USA under Twilio's DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
- Stripe — billing and subscription payments, when checkout is enabled; Stripe handles card data.
- Resend — transactional e-mail delivery, including the website contact-form notification, when configured (Plus Five Five, Inc., USA); the sending region is eu-west-1 (Ireland), and message content and delivery logs are stored in the USA (30-day retention) under Resend's DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
- GoDaddy — company e-mail hosting for the valeronsystems.com mailboxes (GoDaddy Professional Email on the Titan platform), including the messages sent through the website contact form; the mailboxes run on AWS infrastructure in the USA under the GoDaddy Data Processing Addendum (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
- Cloudflare R2 — object storage for the encrypted database backups, and for uploaded files when configured (Cloudflare, Inc., USA); the backup bucket is bound to the EU jurisdiction, so the stored backups stay in the EU; metadata transfers under Cloudflare's DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).
- GitHub Actions — runs the scheduled database backup job that encrypts the backup and writes it to Cloudflare R2 (GitHub, Inc., USA); the job runs on GitHub-hosted runners (Microsoft Azure infrastructure; the region is not selectable and may be outside the EEA), and the unencrypted dump exists only for the duration of the job; transfers are covered by GitHub's Data Protection Agreement (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework) once the repository is held under the company's GitHub organisation — until then only the backup job's data is handled there, and only encrypted backup archives leave the runner.
- Google — Calendar and Places functions only after the customer connects and enables them.