Subprocessors
Last updated 2026-09-01 · Derived from the platform’s own configuration, not from a sales sheet.
A subprocessor is a company Avieros uses that can touch data belonging to you or your customers. Under the GDPR you are entitled to know who they are, what they do, and where. This page lists every one, and separates the ones processing data today from the ones that are configured but switched off — because a list that blurs the two is misleading in whichever direction you happen to care about.
Processing data today
| Company | What it does for Avieros | What it can see | Where |
|---|---|---|---|
| Supabase | The production database and the authentication system. | Everything stored: business records, contacts, documents, accounts, and the identities that own them. This is the primary store. | United States |
| Vercel | Hosting and serverless execution for every Avieros surface. | Every request in transit, including anything inside it, while it is being served. | United States, with a global edge |
| Cloudflare | DNS and the CDN that fronts the avieros.com hostnames. | Request metadata and, because it terminates TLS at the edge, request content in transit. | Global edge network |
| OpenAI | The language models the AI workforce runs on. | The content of a task it is asked to work on — the text, records or documents included in that specific request. Not the database. | United States |
| Telnyx | SMS and voice, where a business has telephony switched on. | Phone numbers, message contents and call audio for those messages and calls. | United States |
| GitHub | Source code and the automated checks that run on every change. | Code and build logs. Not customer data — and an automated scan over the full history exists to keep it that way. | United States |
| Google Fonts | The two typefaces this Trust Center loads. | Your IP address and browser, when your browser fetches a font file from Google. It is the only third-party request this site makes. | Global edge network |
Configured, but switched off today
These are wired into the platform and are not processing anything at present. They are listed because a subprocessor that can be enabled by a configuration change is a subprocessor you should know about before it is.
| Company | What it would do | Current state |
|---|---|---|
| Stripe | Payments, subscriptions and payouts. | Off. Billing and both Stripe modes are disabled — no payment is being processed by Avieros today, which is also why the marketplace states no price. |
| Resend | Outbound transactional email. | Off. Email sending is disabled. |
| OpenSRS | Domain registration on a member’s behalf. | Off, and running against a simulator rather than the live registrar. |
| LiveKit, fal, Telegram | Real-time media, media generation, and founder-side operational alerts respectively. | Present in configuration; not in the path of customer data today. |
The rules that apply to all of them
- None of them is given your data to use for themselves. Avieros does not sell, rent, or share your data for anyone’s marketing, and a subprocessor is not a route around that.
- Least privilege at the edges too. Public surfaces read through narrowly scoped credentials against explicit public views — not through keys that could read everything. See Security for the worked example.
- A new subprocessor changes this page. If something is switched on, it moves from the second table to the first, and this page is where you find out.
There is no signed Data Processing Addendum published here, and no Standard Contractual Clauses pack to download. Both are normal asks from a data protection officer and Avieros does not have them to give yet. Saying so is more useful to your DPO than a page that implies otherwise. Data is processed in the United States; if your assessment needs the paperwork rather than the list, write to privacy@avieros.com and you will get a straight answer about what exists.
Back This site runs no script, so it cannot know where you came from and will not pretend to. The Trust Center overview is here.