Sub-processors
Last updated: 12 September 2026 · Auf Deutsch lesen
Cuvanti, Inc. uses the following third parties to process personal data on behalf of its customers in providing the Service. Before any of them processes personal data, it is bound by a written data processing agreement that carries at least the protections in our Data Processing Addendum, and each processes data only for the purpose listed. Where that agreement is not yet in place, the entry says so and no personal data is sent until it is.
| Sub-processor | Purpose | Processing location | Transfer mechanism (EEA, UK and Switzerland) |
|---|---|---|---|
| Vercel Inc. | Hosting and edge delivery of the application | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Supabase Inc. | Database and file storage | United States | Standard contractual clauses |
| Amazon Web Services, Inc. | Infrastructure underlying the database and file storage | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Resend (Plus Five Five, Inc.) | Transactional e-mail delivery | United States | Standard contractual clauses |
| Stripe, Inc. | Payments, payouts and subscription billingCustomers in the EEA contract with Stripe Payments Europe, Ltd. (Ireland). | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| PostHog, Inc. | Product analytics and, on the public website only, session replayIn the EEA, the UK and Switzerland this runs only after you accept analytics cookies. | United States | Standard contractual clauses |
| Twilio Inc. | SMS notifications | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Tencent (WeChat Official Accounts Platform) | Messages that followers send to the Cuvanti WeChat Official Account, and replies to themOnly what a person chooses to send to the account reaches Tencent; Cuvanti stores the message and the reply. | China and Singapore | Standard contractual clauses |
| Fixie (Cascade Web Services, LLC) | Fixed-address relay for the calls Cuvanti makes to the WeChat Official Accounts PlatformThe relay carries the encrypted connection to Tencent; it sees the destination and the volume, not the content of any message. | United States | Standard contractual clauses |
| Meta Platforms, Inc. (WhatsApp Business Platform) | WhatsApp notifications and conversationsUsers in the EEA are served by Meta Platforms Ireland Limited. | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Anthropic, PBC | AI features (drafting, categorisation, analysis), under terms that exclude training on customer dataSee https://cuvanti.com/trust/ai for what the AI features can and cannot see. | United States | Standard contractual clauses |
| Google LLC | Maps and address lookup; where you have accepted analytics and advertising cookies, Google Analytics and Google Ads measurement | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Channex.io Ltd | Channel manager connecting short-stay listings to booking platforms: availability, rates and reservations, including guest names and contact detailsUsed only for customers who enable Cuvanti Stays. | United Kingdom | Adequacy decision (EU and UK); no transfer tool required |
| Plaid Inc. | Bank account connection and transaction feeds for reconciliation, when a customer in the United States connects a bank account | United States | Standard contractual clauses |
| Basiq Pty Ltd | Bank account connection and transaction feeds for reconciliation, when a customer in Australia connects a bank account | Australia | Standard contractual clauses |
| Akahu Technologies Limited | Bank account connection and transaction feeds for reconciliation, when a customer in New Zealand connects a bank account | New Zealand | Adequacy decision (EU and UK); no transfer tool required |
| Functional Software, Inc. (Sentry) | Application error monitoring; configured to exclude personal identifiers, so error reports carry technical context only | United States | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Upstash, Inc. | Rate limiting to protect sign-in and public forms from abuse; holds short-lived counters keyed on hashed identifiers | United States | Standard contractual clauses |
| Cloudflare, Inc. | Bot protection (Turnstile) on the registration and contact forms; processes the visitor's IP address and browser signals to tell a person from a script | United States, with edge processing worldwide | Standard contractual clauses; EU-US Data Privacy Framework certified |
| Monoova Payments Pty Ltd | Australian payment rail for owner and supplier payouts, when an Australian customer pays out through Cuvanti; processes payee names and bank account detailsAgreement not yet in place: no personal data is processed by this provider until it is signed. | Australia | Standard contractual clauses |
Changes to this list
We give at least 30 days' notice before a new or replacement sub-processor processes customer personal data. Notice is given by updating this page and by e-mail to each customer's account administrators. A customer may object on reasonable data protection grounds by writing to privacy@cuvanti.com within that period; the Data Processing Addendum sets out what happens then.
Announced changes
New sub-processor: Fixie (United States): fixed-address relay for Cuvanti's calls to the WeChat platform; carries the encrypted connection only.
Announced 21 September 2026 · Effective 21 October 2026
New sub-processor: Tencent (WeChat Official Accounts Platform, China and Singapore): messages followers send to the Cuvanti WeChat account and the replies.
Announced 21 September 2026 · Effective 21 October 2026
New sub-processor: Cloudflare, Inc. (United States): bot protection on the registration and contact forms.
Announced 12 September 2026 · Effective 12 October 2026
New sub-processor: Monoova Payments Pty Ltd (Australia): payment rail for payouts by Australian customers.
Announced 12 September 2026 · Effective 12 October 2026
New sub-processor: Channex.io Ltd (United Kingdom): channel manager for Cuvanti Stays reservations.
Announced 10 September 2026 · Effective 12 October 2026
New sub-processor: Plaid Inc. (United States): bank feeds for customers who connect a US bank account.
Announced 10 September 2026 · Effective 12 October 2026
New sub-processor: Basiq Pty Ltd (Australia): bank feeds for customers who connect an Australian bank account.
Announced 10 September 2026 · Effective 12 October 2026
New sub-processor: Akahu Technologies Limited (New Zealand): bank feeds for customers who connect a New Zealand bank account.
Announced 10 September 2026 · Effective 12 October 2026
New sub-processor: Functional Software, Inc. (Sentry, United States): application error monitoring without personal identifiers.
Announced 10 September 2026 · Effective 12 October 2026
New sub-processor: Upstash, Inc. (United States): rate limiting on hashed identifiers.
Announced 10 September 2026 · Effective 12 October 2026