Trust

Sub-processors

Third parties we use to provide the Services. We maintain a data processing agreement with each, review their compliance annually, and update this list when it changes. Last reviewed: April 14, 2026.

Provider	Purpose	Location	Data processed	Compliance
Vercel	Application hosting, compute, edge network	Global (primary: US-East)	Request metadata, served content	SOC 2 Type II, ISO 27001
Neon	PostgreSQL database	US-East	Organization, user, verification, API key records	SOC 2 Type II
Sumsub	KYC, KYB, and background verification backend	EU + US data centers	Identity documents, liveness data, business registry data (during verification only)	SOC 2, ISO 27001, GDPR compliant
Stripe	Billing and payment processing	US (EU customers served via Stripe Ireland)	Billing email, organization name, payment method metadata	PCI DSS Level 1, SOC 1, SOC 2
Resend	Transactional email delivery	US	Recipient email addresses, email content	SOC 2 Type II
Upstash	Rate limiting and caching (when enabled)	Global edge	API key hashes and rate limit counters (no PII)	SOC 2 Type II

Notification of changes

We notify customers at least 30 days before adding or replacing a sub-processor that will process personal data. Subscribe to updates by emailing security@enemoverify.com.