Skip to content
Vibely

Subprocessors

The third-party services Vibely uses to store, process, and transmit customer data. Each is engaged under that vendor’s own published data processing terms where it offers them. We do not hold a negotiated agreement with every vendor, and we do not claim every vendor’s terms match our Data Processing Agreement. The current position, vendor by vendor, is available from [email protected].

ServicePurposeLocation
Amazon Web Services (EC2, S3, SSM)Cloud hosting, object storage, and secret/parameter storageUS (us-east-1)
SupabasePostgreSQL database, authentication, and file storageSingapore (ap-southeast-1)
VercelFrontend application hosting and edge deliveryUS (iad1)
Redis (managed)Rate-limit counters, role cache, and short-lived session stateUS
E2BIsolated sandboxes that execute generated codeUS
CloudflareDNS, CDN, and custom-domain (SaaS) routingGlobal edge
RazorpayCard payment processing (USD) — the only payment processor for Vibely itselfIndia
ResendTransactional and marketing email deliveryUS
SentryError tracking and observabilityUS
PostHogProduct analytics and session replay (analytics cookies only, and only with your consent)US / EU
LangSmith (LangChain)LLM call tracing. Receives operational metadata only — model, provider, message counts, token usage, latency and errors. Prompt and response text is stripped before it leaves our serversUS
DeepSeekAI model inference (default primary model)China
OpenAIAI model inference (image + description models)US
Google (Gemini)AI model inference (failover + vision)US
AnthropicAI model inference (Claude)US
Fal.aiAI image generation and editingUS / EU
Fireworks AIAI model inference (Zhipu GLM)US
OpenRouterAI model inference routing (e.g. DeepSeek models), when configured; forwards each request to the serving model providerUS (routes to upstream providers)
TavilyWeb search performed by the agent during a build, when it needs current informationUS
FirecrawlWeb page fetching and extraction when you ask the agent to reference or clone a pageUS
ComposioConnector OAuth gateway — custodies the third-party access tokens you authoriseUS
GitHubRepository sync for projects you connect — the GitHub App reads and writes the repositories you grant itUS
Expo (EAS)Native mobile build pipeline for iOS and Android binariesUS

This list reflects the services Vibely provisions today and is updated as the stack changes. For the full subprocessor schedule — including the specific data categories each vendor processes and whatever contractual safeguards we hold for it — contact [email protected]. It is provided under NDA.

We do not claim a specific transfer mechanism for every subprocessor. Our US and EU subprocessors are engaged under their own published data processing terms, which incorporate the European Commission’s Standard Contractual Clauses where the vendor offers them. DeepSeek processes data in China and we do not hold Commission-approved Standard Contractual Clauses with it. DeepSeek is used under its standard terms, which permit using inputs to improve its models. OpenAI, Anthropic, Google and Fireworks each state in their own published API terms that API inputs are not used to train their models — their published commitment, not one we negotiated or can audit. See International transfers in our Privacy Policy and in our DPA.

Last reviewed: September 22, 2026. This page is the notice required by our DPA: we post a change here at least 30 days before a new subprocessor begins processing customer personal data, update the date above, and email workspace owners at the same time.