VesselTwin Subprocessors
Last updated 2026-05-19
1. About this list
A "subprocessor" is a third party that processes personal data on VesselTwin's behalf to deliver the service to you. The list below names each subprocessor, what we use them for, what categories of data they receive, and the primary processing region.
VesselTwin has signed a data-processing agreement (DPA) or operates under an equivalent contractual arrangement (e.g., AWS's account-level DPA) with each subprocessor. Where applicable, EU-to-US transfers are covered by Standard Contractual Clauses or by the relevant data-privacy framework adequacy decision in force at the time.
2. Current subprocessors
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Clerk, Inc. | User authentication, sign-in, session management, organization membership. | Email, name, avatar URL, password hash, OAuth identifiers, IP address, user agent, sign-in events. | United States (with EU residency option) |
| Svix, Inc. | Signed webhook delivery from Clerk (account events → VesselTwin backend). | Webhook event metadata (Clerk user IDs, event timestamps). No vessel data. | United States |
| Amazon Web Services, Inc. (AWS) | Application hosting (ECS), object storage (S3 + CloudFront CDN), transactional email (SES), SMS delivery (SNS), AI model inference (Bedrock), document database (DynamoDB). | All vessel records, uploaded photos and documents, transactional email content and recipients, SMS message content and recipients, AI inputs (document text + image excerpts sent to Bedrock). | United States (us-east-1 primary) |
| Google LLC (Google Cloud — Vertex AI) | AI model inference for document extraction and content understanding. | Document text and image excerpts sent for extraction. Configured with data-residency and no-training settings (see §3). | United States / EU (configurable per request) |
| Vercel, Inc. (AI Gateway) | AI model request routing — proxies inference requests to upstream model providers (e.g., Anthropic, OpenAI) under VesselTwin's account. | AI inputs in transit; logged for operational metrics only, not retained for training. | United States |
| Anthropic, PBC | AI model inference — applies when the AI Gateway routes a request to a Claude model. | Whichever AI inputs were routed to a Claude model (document text, image excerpts). Anthropic API terms prohibit using API inputs/outputs to train their models by default. | United States |
| Cloudflare, Inc. | Web app hosting (Cloudflare Pages) and CDN for static assets. | HTTP request metadata (IP address, user agent, requested path) for static asset and page delivery. No vessel content stored at Cloudflare. | Global edge network |
3. AI processing and "no training"
VesselTwin instructs each AI subprocessor to process inputs solely to generate the requested output and not to use them for training the provider's underlying models. Configuration today:
- AWS Bedrock — provider terms prohibit using customer inputs to train or improve foundation models.
- Google Vertex AI — Vertex AI customer data is not used to train Google's foundation models under the Vertex AI service terms.
- Vercel AI Gateway — passes requests through to the upstream provider; the upstream provider's no-training terms apply.
- Anthropic API — Anthropic does not use API inputs/outputs to train its models by default.
4. Notification of changes (GDPR Art. 28(2))
When we add a new subprocessor or replace an existing one, we will update this page and move the "Last updated" date. Customers under an enterprise or fleet-tier DPA may request advance written notification of new subprocessors with opportunity to object — email privacy@vesseltwin.io to be added to the notification list. We aim to provide at least 30 days' advance notice for material additions where reasonably practicable.
5. Contact
Questions about a specific subprocessor, our DPA, or data-residency options? Email privacy@vesseltwin.io. For security incidents, contact security@vesseltwin.io.