Last updated: October 30, 2026. This list is incorporated into the Veilbrook DPA (Annex III).
Veilbrook (Nwbrains LLC) uses the following subprocessors to provide the service. We will give at least 30 days’ prior notice of any new subprocessor that processes customer data, by email to account administrators and by updating this page. Customers may object on reasonable data-protection grounds within 15 days; if the objection cannot be resolved, the affected service may be terminated without penalty with a pro-rata refund of prepaid fees.
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Modal Labs, Inc. | Model inference on document text for personal-data detection (no document files) | United States (us-east) | DPA; EU SCCs / UK Addendum; TLS; no persistent document storage by Veilbrook |
| Hetzner Online GmbH | Application hosting, PostgreSQL metadata, temporary PDF processing | Germany (EU) | DPA; EU hosting; access controls; TLS |
| Cloudflare, Inc. | Website delivery, DNS, email routing | United States / global | DPA; EU SCCs; TLS |
| Resend, Inc. (Plus Five Five, Inc.) | Transactional email delivery: account email address, verification/reset links and notices; no document content | European Union (eu-west-1) | DPA; EU SCCs / UK Addendum; TLS |
| Stripe, Inc. (when payments are enabled) | Payment and subscription billing (account/billing data, not document content) | United States | DPA; EU SCCs; PCI DSS (Stripe) |
Veilbrook does not store the contents of customer documents after processing. Document text used for detection is sent over TLS to Modal for inference and is not persisted by Veilbrook. No customer documents are stored on Vast.ai, on the tt-ingest station, or in any environment not listed above.
Questions or objections: privacy@veilbrook.com.