Sub-Processor List - Eight Versa Platform
Prepared for client data processing disclosure. Last reviewed: June 2026. Scope: All third-party services that process personal data or client data on behalf of Eight Versa in the operation of the Vero platform.
Infrastructure & Hosting
| Sub-processor | Role | Personal / Client Data Processed | Processing Location | Transfer Mechanism |
|---|---|---|---|---|
| Google LLC (Google App Engine) | Application server — hosts the Vero API | All data submitted to the platform passes through; user credentials, session tokens, request payloads | EU | UK Addendum to EU SCCs; Google Cloud DPA |
| Google LLC (Cloud Storage) | File and document storage | Uploaded documents, project files, images | EU | UK Addendum to EU SCCs |
| Google LLC (Cloud Run) | Serverless compute for AI agent execution | Project data and carbon footprint data submitted to agent tasks | EU | UK Addendum to EU SCCs |
| Google LLC (Cloud Logging) | Application and audit logging | Log entries include user email addresses, IP addresses, request metadata | EU | UK Addendum to EU SCCs |
| MongoDB Inc. (Atlas) | Primary database | All user personal data (names, email addresses, hashed passwords, roles), all client project and carbon data | EU | UK Addendum to EU SCCs; MongoDB DPA |
| Vercel Inc. | Frontend application hosting | IP addresses and browser metadata via HTTP access logs; no persistent personal data stored | USA (global edge network) | UK SCCs (IDTA); Vercel DPA |
| Cloudflare Inc. | CDN, WAF, DDoS protection, DNS | IP addresses, HTTP request headers, authentication request metadata | Global edge; primary processing USA | UK SCCs (IDTA); Cloudflare DPA; EU-US DPF certified |
Communication Services
| Sub-processor | Role | Personal / Client Data Processed | Processing Location | Transfer Mechanism |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft 365 / Graph API) | Transactional email delivery and SharePoint file management | User names, email addresses, email body content (includes 2FA codes, password reset links, notifications); SharePoint project folder structure | EU | UK Addendum to EU SCCs; Microsoft DPA; EU-US DPF certified |
AI & Machine Learning
| Sub-processor | Role | Personal / Client Data Processed | Processing Location | Transfer Mechanism |
|---|---|---|---|---|
| Google LLC (Vertex AI) | Embeddings generation for all platform content (all clients); Gemini LLM completions and AI agent orchestration — where client opts out of non-EU AI processing | Platform content submitted to the API — may include project descriptions, carbon data, supplier information, carbon footprint data, project context and user queries | EU | UK Addendum to EU SCCs |
| OpenAI OpCo LLC | AI completions (carbon data analysis, document processing) — where client consents to non-EU AI processing | Platform content submitted to the API — may include project descriptions, carbon data, supplier information | USA | UK SCCs (IDTA); OpenAI DPA |
| Anthropic PBC | AI agent orchestration via Claude API and MCP server — where client consents to non-EU AI processing | Platform content submitted to agent tasks — carbon footprint data, project context, user queries | USA | UK SCCs (IDTA); Anthropic DPA |
| Google LLC (Cloud Vision API) | OCR — optical character recognition for uploaded documents | Document image content, extracted text from uploaded files | EU | UK Addendum to EU SCCs |
| Google LLC (Cloud Document AI) | Intelligent document processing | Document content including any personal data present in uploaded files | EU | UK Addendum to EU SCCs |
Business Application Integrations
| Sub-processor | Role | Personal / Client Data Processed | Processing Location | Transfer Mechanism |
|---|---|---|---|---|
| PandaDoc Inc. | Document generation — contracts and proposals | Names, email addresses, company information, contract terms included in generated documents | USA | UK SCCs (IDTA); PandaDoc DPA |
| Google LLC (Maps Distance Matrix API) | Distance and logistics calculations | Location coordinates and addresses submitted for distance calculations | USA / Global (Google) | UK Addendum to EU SCCs |
Notes on Data Categories
Personal data processed across the platform includes:
- User account data: names, email addresses, hashed passwords, roles, company affiliation
- Authentication metadata: IP addresses, login timestamps, session tokens
- Client/project data: company names, project descriptions, carbon footprint data, energy consumption data, supplier information
- Documents: uploaded files which may contain personal data depending on content
Data Eight Versa does not send to sub-processors:
- Raw (unhashed) passwords — bcrypt hashed at rest, never transmitted externally
- Payment card data — no payment processing is handled on-platform
