Trust center
Sub-processors
This page lists the third-party service providers OvrenLabs SARL-S uses to deliver OnCompli. Customers should treat this as an operational disclosure, not a substitute for the signed DPA.
Last updated: July 14, 2026
Provider
Purpose
Data categories
Location notes
Supabase
Authentication, Postgres database, and object storage infrastructure
Account identifiers, tenant data, evidence metadata, and uploaded evidence files
EU (Frankfurt) — primary storage of Customer Data
Vercel
Application hosting, edge network, deployment logs, and serverless execution
HTTP request metadata, application logs, and runtime telemetry
Server-side processing in the EU (Frankfurt); global edge network for content delivery, under SCCs
Stripe
Subscription checkout, billing portal, invoices, tax, and payment processing
Billing contacts, subscription records, payment metadata, and tax identifiers
EU contracting entity (Dublin); global processing under SCCs
Resend
Transactional email delivery for invites, alerts, billing, and operational notifications
Recipient email addresses, message metadata, and template content
US, under SCCs
Sentry
Error monitoring, release health, and production diagnostics
Error traces, scrubbed request metadata, and diagnostic context
Configured Sentry project region and GDPR transfer safeguards
Upstash
Redis-backed rate limiting and operational queues where enabled
Rate-limit keys, request counters, and job metadata
Region configured per environment
Plausible
Privacy-preserving website analytics
Aggregated website usage data without cross-site tracking cookies
EU-hosted analytics processing
PostHog
Product analytics and feature usage telemetry, only where analytics consent is given
Authenticated product usage events subject to customer/user consent and product settings
US (or EU region where configured for the deployment), under SCCs
OpenAI
Optional AI-assisted generation and analysis. Engaged only where the customer explicitly enables AI features; the default strict mode sends no customer data to AI providers.
Minimized prompts and generated outputs; Strict mode does not call AI services
US, under SCCs and the applicable provider DPA
Customer notice
We notify customers of material changes to this list at least 30 days in advance, in accordance with our Data Processing Agreement. Customers can contact privacy@oncompli.com for DPA, transfer, or vendor due-diligence questions.