Sub-processors
These are the third parties that process customer data on Veracrat's behalf. We will update this page before adding a new sub-processor that handles scan images or inventory data.
Current list
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Application & database hosting | Hosts the application, the tenant database, and the private scan-image bucket | Account data, inventory records, scan images, findings | United States |
| Lovable AI Gateway | Routes scan images and the expected-inventory summary to the model provider | Scan image, rack label, expected asset list | United States |
| Model provider (Google, via the gateway) | Generates the detections and notes returned for each scan | Scan image, rack label, expected asset list | United States |
| Transactional email provider | Delivers account, renewal-reminder, and support email | Email address, message content | United States |
| Payment processor (PCI-DSS compliant) | Processes card payments for paid plans; engaged only once card billing is enabled | Billing contact, card data (handled by the processor, never stored by Veracrat) | United States |
| Customer-connected DCIM / ITSM systems | Only the systems a customer explicitly connects; data flows in the direction the customer configures | Inventory records, scan verdicts | Customer-controlled |
Transfers
We do not use third-party product-analytics, advertising, or data-broker services, and no processor is permitted to train models on customer content.
Processing takes place in the United States. Transfers out of the UK and EEA rely on the UK IDTA / EU Standard Contractual Clauses. If your organisation requires processing to remain in a specific region, contact us before starting a pilot — we cannot currently guarantee in-region AI inference.
Notice of changes
Customers on a paid plan are notified by email at least 30 days before a new sub-processor that handles scan images or inventory data is added.
This page is maintained by Veracrat. It describes our current practices and is not an independent certification or legal advice. Questions: privacy@veracrat.com.