Sub-processors

Last updated: 2026-07-20

Innovedge Labs Inc. ("Innovedge Labs", "we", "us") engages the third-party sub-processors listed below to help provide Engrama (the "Service"). Each sub-processor is bound by contract to protect Customer Data and to use it only to provide its service to us. This page is the current sub-processor list referenced in our data processing terms.

Where Customer Data is stored

The Engrama document repository and its metadata (your Customer Data at rest) are stored exclusively in Canada, in the AWS ca-central-1 region (Montreal), through Supabase and AWS. Some processing of data in transit occurs outside Canada: application requests run on our hosting provider's default United States region, and AI features send document excerpts to inference providers in the United States. The table below identifies each sub-processor and the region where it processes data.

Sub-processor	Purpose	Data processed	Processing region
Supabase	Database, authentication, and file storage.	All Customer Data: documents, extracted text, metadata, and account identities.	Canada (ca-central-1, Montreal)
Amazon Web Services (AWS)	Asynchronous document-processing compute, queues, and secrets storage.	Parsed document text in transit; encrypted secrets at rest.	Canada (ca-central-1, Montreal)
Vercel	Application hosting and request delivery.	Requests and responses transit and are processed here, so Customer Data passes through in transit.	United States (default region), plus a global edge network
Anthropic	AI document understanding and chat.	Document excerpts and chat messages, sent at the time a request is processed.	United States
OpenAI	Text embeddings for search and retrieval.	Document excerpts converted into embedding vectors, which are stored back in Supabase. No document generation.	United States
Stripe	Payment processing.	Billing and subscription details. Card data is entered on Stripe-hosted checkout and never reaches Engrama.	United States, plus global processing
Resend	Transactional and authentication email.	Recipient email address and message content, for example sign-up and password-reset mail.	United States
PostHog	Product analytics.	De-identified product-usage events only. No document content.	European Union (Frankfurt)
Sentry	Error monitoring.	Application error reports, with personal data scrubbed before it is sent.	United States
Google, Microsoft, or Dropbox	Access to files you choose to import, only if you connect one of these accounts.	Only the files you explicitly select for import, transferred at your direction.	Your account's region

Notes

Customer Data at rest (your documents and their metadata) is stored only in Canada. Processing in transit by our hosting and AI sub-processors may occur in the United States, as indicated in the table.
AI sub-processors (Anthropic, OpenAI) receive only the document excerpts needed to answer a given request. We have requested zero-data-retention terms from these providers; standard API retention applies until those terms are confirmed.
Product analytics (PostHog) is limited to de-identified usage events, can be disabled per deployment, and never receives document content.
The Customer Data stored in Canada is held by US-incorporated providers (Supabase, Inc. and Amazon Web Services, Inc.) operating Canadian data centres. The data itself remains physically located in Canada.

Changes to this list

We update this page before engaging a new sub-processor that processes Customer Data. Customers with a signed data processing agreement may request advance notice of changes as set out in that agreement.

Questions

For questions about this list, or to request notice of changes to it, contact us at info@innovedgelabs.com.