Legal
Subprocessors
Effective July 14, 2026
VendMetric uses a small number of third-party providers to operate the platform. Each one is listed below with the data it handles. We update this page before adding a new subprocessor that processes Customer Data.
| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Application traffic and request logs. Vendor documents are not stored on Vercel. | United States |
| Supabase | Database and encrypted document storage | Organization, user, vendor, and compliance records; uploaded vendor documents. | United States (us-east-1) |
| Anthropic | AI document extraction and anomaly review | Contents of uploaded vendor documents, processed to extract expiration dates, coverage amounts, and related metadata. | United States |
| Resend | Transactional email delivery | Recipient email addresses and the contents of reminder, invitation, and notification emails. | United States |
A note on AI processing
Document contents are sent to Anthropic solely to extract compliance metadata — expiration dates, coverage amounts, policy numbers, and document type. Extracted values are always presented to a human reviewer in your organization before they affect a compliance record; VendMetric does not act on AI output without human confirmation.
Notification of changes
Customers who would like advance notice of subprocessor changes can request it at privacy@vendmetric.com.
See also our Privacy Policy, Terms of Service, and security posture.