Subprocessors
Last updated:
The service providers VeloWise uses to run the website and app, what each one does, what personal information it receives and where it processes it.
| Provider | Purpose | Personal information | Location |
|---|---|---|---|
| Amazon Web Services (S3, CloudFront) | Hosting and delivering the website’s static files | Request details needed to serve a page: IP address, requested URL, browser user agent | CloudFront edge locations worldwide; files stored in the AWS region configured for this deployment |
| Supabase (Postgres, Auth, Edge Functions) | Database, sign-in and server-side functions for accounts and organizations | Account email and sign-in identity; organization memberships; organization imports; encrypted Jira tokens; shared report snapshots and access logs; billing status; staff audit log | The region configured for this deployment |
| Stripe | Checkout, subscriptions and the billing portal for paid plans | Your email address and account ID; payment details you enter directly with Stripe, which VeloWise never receives | United States and other countries where Stripe operates |
| Atlassian | Source of Jira data, only when you connect Jira | The OAuth authorization you grant and the read-only API requests made on your behalf | Where your Atlassian site is hosted, under your own agreement with Atlassian |
| Google (Analytics 4, AdSense) | Usage analytics and ads on public pages, only after you consent | IP address, browser and device information, cookie identifiers, page URLs without query strings, product events. Never imported delivery data. | United States and other countries where Google operates |
Notes
- Delivery data you import while signed out stays in your browser and reaches none of these providers.
- Supabase holds organization customer data. Google receives no organization customer data, and Atlassian is the system the data comes from.
- Transfers outside the EU, EEA or UK rely on the EU-US Data Privacy Framework or its UK Extension where the provider is certified, otherwise on Standard Contractual Clauses. See the privacy policy and the Data Processing Addendum.
- When this list changes, we update this page and the date above. Questions: the operator of this deployment.