This directory identifies the external providers Venge currently relies on to deliver the service. It is part of the Data Processing Addendum and will be kept current as the operating setup changes.
01How to read this directory
A provider is listed when it may process personal data while helping Venge operate the service. A provider may not receive every category of data, and some integrations are only used when a customer chooses the related feature.
We do not list software that runs solely within Venge’s own environment as a separate subprocessor. For example, the application uses SQLite for its operational database, but SQLite is not a hosted provider receiving customer data from Venge.
02Infrastructure and delivery
Amazon Web Services, Inc. (Lightsail)
Application hosting and operational database storage. The production service
is operated as a long-lived Node process on an AWS Lightsail instance.
Cloudflare, Inc.
Content delivery, TLS termination, DNS, inbound email routing, and object
storage for file attachments and database backups. Cloudflare sits
in front of the production application, and stores files uploaded to
workspace discussions and to the staff mailbox.
03Billing and communications
Stripe, Inc.
Subscription checkout, billing portal, payment processing, and subscription
status. Venge stores Stripe customer and subscription identifiers needed to
manage service access; card details are handled by Stripe.
Amazon Web Services, Inc. (Amazon SES)
Outbound transactional email, including account verification, password reset,
invitation, account-closure, and booking-confirmation messages. This service
is used when the required mail credentials are configured.
04Optional sign-in providers
Google LLC
Optional OpenID Connect sign-in. Google is involved only when a customer or
user chooses Google sign-in and Venge has enabled that provider.
Microsoft Corporation
Optional OpenID Connect sign-in through Microsoft identity services. Microsoft
is involved only when a customer or user chooses Microsoft sign-in and Venge
has enabled that provider.
X Corp.
Optional OAuth 2.0 sign-in through X. X is involved only when a customer or
user chooses X sign-in and Venge has enabled that provider.
05Provider locations and safeguards
These providers operate globally and may process data in more than one country. Their applicable service terms, data-processing terms, and transfer safeguards govern their processing for Venge. We do not represent a specific provider location, certification, or transfer mechanism unless it is confirmed for the relevant production configuration.
06Changes to this directory
Before adding or replacing a provider that may process Customer Personal Data, we will update this directory and aim to give at least 30 days’ notice where reasonably practicable. We may make a change sooner where required for security, legal compliance, continuity of service, or by a provider’s own change.
If you have a question about a listed provider or need notice of a change, contact [email protected]. See also our Data Processing Addendum.