Subprocessors
These are the third-party services that handle some part of Total Vault's operations. Each one only receives the minimum data needed to do its job.
1. Current list
| Vendor | Purpose | Data | Location | Policy |
|---|---|---|---|---|
| Backblaze | Encrypted object storage for your files and thumbnails | File contents, derived thumbnails, file metadata | United States | View ↗ |
| Neon | Managed Postgres database (files, folders, activity, audit log) | Account info, file metadata, hashes, activity records | United States (US-East) | View ↗ |
| Vercel | Web hosting and edge serving | Request logs, IP addresses, application traffic | United States | View ↗ |
| Cloudflare (realtime) | Realtime sync and presence (live multi-user updates) | Organization and user IDs, presence signals, file and project event IDs | United States / global edge | View ↗ |
| Cloudflare R2 | Storage for derived video assets (poster, preview clip, 1080p proxy) | Derived video assets only (never originals) | United States / global edge | View ↗ |
| Inngest | Background-job runner for verification and AI tasks | Job payloads (file IDs, organization IDs) | United States | View ↗ |
| Resend | Transactional email (sign-in codes, receipts) | Recipient email address, email subject and body | United States | View ↗ |
| Stripe | Payment processing and subscription billing | Billing contact, subscription status, payment-method details (held by Stripe) | United States | View ↗ |
| Anthropic | AI rename, event grouping, and natural-language search | Thumbnails, filenames, EXIF metadata, queries | United States | View ↗ |
| Cohere | Image embeddings for visual similarity search | Thumbnails (no originals) | Canada / United States | View ↗ |
| Sentry | Error and performance monitoring | Error events, request metadata, IP address | United States | View ↗ |
| Cloud import source (read-only Google Drive) | Encrypted OAuth token, file metadata, and the files you choose to import | United States | View ↗ | |
| Dropbox | Cloud import source (read-only) | Encrypted OAuth token, file metadata, and the files you choose to import | United States | View ↗ |
2. When this list changes
We will update this page before adding a new subprocessor or removing an existing one. Account owners can subscribe to change notifications by emailing support@totalvault.ai — we’ll send a brief notice at least 14 days in advance for any change that materially affects how customer data is processed.
3. Contractual safeguards
Each of the vendors above is bound by a written data-processing agreement (or equivalent) that requires them to handle customer data only on our instructions, maintain industry-standard security controls, and notify us of any incident. We have configured AI vendors to disable training on customer inputs and to retain request payloads only as long as needed to deliver the response.
Cloud import sources (Google Drive, Dropbox) are connected only when you choose to import from them, using read-only access. We never modify or delete anything in your connected accounts, and you can disconnect them at any time.