Subprocessors
These are the third-party services that handle some part of Total Vault's operations. Each one only receives the minimum data needed to do its job.
1. Current list
| Vendor | Purpose | Data | Location | Policy |
|---|---|---|---|---|
| Backblaze | Encrypted object storage for your files and thumbnails | File contents, derived thumbnails, file metadata | United States | View ↗ |
| Neon | Managed Postgres database (files, folders, activity, audit log) | Account info, file metadata, hashes, activity records | United States (US-East) | View ↗ |
| Vercel | Web hosting and edge serving | Request logs, IP addresses, application traffic | United States | View ↗ |
| Cloudflare (realtime) | Realtime sync and presence (live multi-user updates) | Organization and user IDs, presence signals, file and project event IDs | United States / global edge | View ↗ |
| Cloudflare R2 | Storage for derived video assets (poster, preview clip, 1080p proxy) | Derived video assets only (never originals) | United States / global edge | View ↗ |
| Cloudflare Workers | Cloud imports (copying files you choose from Google Drive or Dropbox into your vault) | The files you choose to import, in transit; job and file IDs | United States / global edge | View ↗ |
| Fly.io | Video conversion worker (web-playable versions of your videos) | Videos while they convert | United States (US-East) | View ↗ |
| RunPod | GPU video conversion for some large videos | Videos while they convert (short-lived access links to the file) | United States / global | View ↗ |
| Cloudflare Stream | On-demand playback for video formats browsers can't play (HEVC, ProRes, …) | A copy of the video you opened, deleted after about 31 days | United States / global edge | View ↗ |
| Inngest | Background-job runner for verification and AI tasks | Job payloads (file IDs, organization IDs) | United States | View ↗ |
| Resend | Transactional email (sign-in codes, receipts) | Recipient email address, email subject and body | United States | View ↗ |
| Stripe | Payment processing and subscription billing | Billing contact, subscription status, payment-method details (held by Stripe) | United States | View ↗ |
| Anthropic | Photo descriptions, reading scanned pages, and understanding searches (with Smart search on) | Photo previews and scanned-page images, filenames, camera metadata, search words (never originals) | United States | View ↗ |
| Cohere | Image embeddings for visual similarity search (with Smart search on) | Thumbnails and search words (no originals) | Canada / United States | View ↗ |
| Sentry | Error and performance monitoring (session replay is off) | Error events, request metadata, IP address, browser and device type | United States | View ↗ |
| Google Analytics | Website visit statistics (analytics only; ad features off, off until accepted in Europe, off with Global Privacy Control) | Pages visited, approximate location, browser and device, a cookie ID | United States / global | View ↗ |
| Apple | Sign in with Apple, Apple Maps (the Places map and naming where a photo was taken), and push notifications on iPhone | Apple sign-in ID and email; photo coordinates for maps; device token and notification text for push | United States / global | View ↗ |
| Sign in with Google and cloud import source (read-only Google Drive) | Google sign-in ID, email and name; for imports, an encrypted OAuth token, file metadata, and the files you choose to import | United States | View ↗ | |
| Dropbox | Cloud import source (read-only) | Encrypted OAuth token, file metadata, and the files you choose to import | United States | View ↗ |
2. When this list changes
We will update this page before adding a new subprocessor or removing an existing one. Account owners can subscribe to change notifications by emailing support@totalvault.ai — we’ll send a brief notice at least 14 days in advance for any change that materially affects how customer data is processed.
3. Contractual safeguards
We use each vendor under its data-processing terms (or equivalent), which require it to handle customer data only on our instructions and keep it secure. We don’t opt in to any AI-provider program that trains models on what we send, and we send previews, not originals. Where vendors handle EU/UK personal data outside Europe, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses (see the Privacy Policy).
Cloud import sources (Google Drive, Dropbox) are connected only when you choose to import from them, using read-only access. We never modify or delete anything in your connected accounts, and you can disconnect them at any time.