Last updated: October 15, 2026
The following categories of third-party service providers ("subprocessors") may process Customer Personal Data on Vedric's behalf in providing the Services. Each subprocessor is engaged under written agreements that impose data protection obligations no less protective than those in our Data Processing Addendum.
Per our DPA, Vedric provides at least thirty (30) days' advance notice before engaging a new subprocessor that will process Customer Personal Data, except where prevented by law or where the new subprocessor replaces an existing one performing the same function. Active Customers can subscribe to update notifications by writing to support@vedric.io.
Except where named in the table below, the specific identity of each subprocessor (vendor name, exact data center region, contractual reference) is shared under NDA with Customers and prospective Customers upon written request to support@vedric.io.
| Function | Purpose | Region |
|---|---|---|
| Cloud infrastructure | Hosting of application servers, databases, and supporting services | United States |
| Edge / content delivery | TLS termination, DDoS mitigation, content delivery for the Services | Global |
| Transactional email delivery | Sending account, security, and operational notifications | United States |
| Error monitoring | Capturing application exceptions to maintain reliability | United States |
| Payment processing | Subscription billing for Customers (where applicable) | United States |
| AI inference (Microsoft Azure OpenAI, US data zone) | AI-assisted triage uses the gpt-6-luna model on Azure OpenAI, deployed in Vedric’s own Azure subscription. It is off until an organization administrator turns it on in Settings. When it is on, alert evidence is pseudonymized, truncated, and secret-scrubbed before it leaves Vedric and can include the documented bounded PowerShell script preview. File payloads, keystrokes, message bodies, and screen data are not sent because they are not collected. While it is off, no alert data is sent to any AI provider and alerts are scored solely by Vedric’s own detection engine. The deployment is restricted to the Azure United States data zone, so requests are processed only in Azure regions in the United States. | United States |
This page is updated when subprocessor categories or functions change. Historical versions are available on request.