Subprocessors

A subprocessor is a third party that Visneo engages to process personal or business data on our behalf in order to deliver the Service. We use the subprocessors listed below; each is bound by a data-processing agreement and may only use the data to provide its service to us.

All listed subprocessors process data in the United States. We do not sell customer or end-user data, and we do not transfer it to a subprocessor for that subprocessor's own marketing.

This list covers infrastructure and integration providers common to all customers. A specific connector only receives data once you choose to connect it (for example, Plaid, Intuit, and Google receive data only after you link a bank account, QuickBooks Online company, or Gmail mailbox).

Service: managed PostgreSQL database, authentication, and file storage — Visneo's primary application data store.

Data processed: account profiles and credentials, workspace and store records, and the operational and financial data Visneo stores on your behalf.

Region: United States. Provider: Supabase, Inc.

Service: application hosting, serverless compute, and content delivery for the Visneo web app and APIs.

Data processed: HTTP request metadata (including IP address and user agent) and any application data transiting the request/response path.

Region: compute in the United States; global content-delivery edge network. Provider: Vercel, Inc.

Service: secure bank-account linking and retrieval of balances and transactions for the cash-position features.

Data processed: the financial-institution account, balance, and transaction data for accounts you choose to link, plus the credentials you enter into Plaid's own secure flow (Visneo never sees those credentials).

Region: United States. Provider: Plaid Inc.

Service: accounting-system synchronization for the books, invoices, and accounts-receivable features (read-only; Visneo does not write back to QuickBooks).

Data processed: the QuickBooks Online company profile, chart of accounts, invoices and customer references, bills and accounts-payable data, sales receipts, deposits, purchases, and profit-and-loss report data you authorize Visneo to read.

Region: United States. Provider: Intuit Inc.

Service: Google account sign-in and, if you choose to connect your mailbox, the legal-mail scanning feature that surfaces compliance-relevant messages.

Data processed — sign-in (all users who sign in with Google): your Google account identifier and profile email, used only to authenticate you.

Data processed — mailbox connection (only if you connect Gmail): read-only access to recent messages (sender, subject, and body) so Visneo can identify legal and compliance mail. Visneo does not send, modify, or delete mail.

Region: United States. Provider: Google LLC.

Service: delivery of SMS alerts (for example, compliance, safety, and urgent operational notifications).

Data processed: recipient phone numbers and the content of the alert messages we send.

Region: United States. Provider: Twilio Inc.

Service: transactional and account email delivery (for example, sign-in, invitations, and notifications).

Data processed: recipient email addresses and the content of the emails we send.

Region: United States. Provider: Twilio Inc. (SendGrid).

Service: web push notifications to browsers that opt in.

Data processed: push-subscription identifiers and basic device/browser metadata, plus the content of the notifications.

Region: United States. Provider: OneSignal, Inc.

Service: the large-language-model analysis behind Visneo's recommendations, summaries, and briefings.

Data processed: the business and operational data Visneo submits for a given analysis, including documents and images you upload for processing (for example, register-close reports), which may incidentally include personal names appearing in your records. Under Anthropic's commercial API terms, this data is not used to train their models.

Region: United States. Provider: Anthropic, PBC.

Service: application error monitoring, performance tracing, and session replay used to detect and debug faults in the Service.

Data processed: error reports and stack traces, which by configuration include request metadata (such as IP address, user agent, and request headers) and server-side variable snapshots present at the time of an error, plus sampled session replays (recordings of in-app browser sessions with text and input fields masked).

Region: United States. Provider: Functional Software, Inc. (Sentry).

Service: application logging and observability used to operate and debug the Service.

Data processed: application and event logs, which may incidentally include identifiers and request metadata.

Region: United States. Provider: Axiom, Inc.

Service: orchestration of Visneo's background jobs and scheduled workflows.

Data processed: the event payloads for those workflows, which carry the operational data a given job acts on.

Region: United States. Provider: Inngest, Inc.

We update this list when we add or remove a subprocessor. Material changes are also reflected in our Privacy Policy. Where a customer agreement requires advance notice of a new subprocessor, we provide it as set out in that agreement.

Questions about our subprocessors can be sent to privacy@visneo.ai or by mail to Visneo, Inc., 2901 W Armitage Ave, Chicago, IL 60647.