Subprocessors

1The list

Four companies, plus the infrastructure provider underneath the database. This is the complete list as of the effective date, and it is part of the Privacy Policy.

Company	What it does for Vega	What it receives	Where
Supabase Inc.	Database, authentication and file storage — the primary store	Everything Vega holds: account records, session content, work moments, the graph, embeddings, and encrypted verbatim prompts and replies	AWS ap-northeast-1, Tokyo, Japan
Amazon Web Services	The infrastructure Supabase runs on	The same data, at rest, as Supabase's own infrastructure provider	ap-northeast-1, Tokyo, Japan
Vercel Inc.	Application hosting and serverless functions	Every request in transit, and server logs. Vega does not write content to its logs, but error strings can carry fragments	Functions pinned to Tokyo (hnd1); platform and logging in the United States
Anthropic PBC	Two different jobs. At capture: the personal-life filter, classification, summarising, capsule writing, anonymisation and interest tagging, plus a daily job that derives session context. At query time: the engine behind every answer Vega gives you about your own work, and behind coaching	Session text, at both moments. The filter sees the first 1,800 characters of every capture, before storage. The daily job sends a decrypted transcript of a session, up to 28,000 characters. Every question you ask Vega sends your own retrieved moments and decrypted excerpts of the turns behind them — up to 600 characters per turn	United States
Resend	Transactional email	Your email address, and the contents of sign-in codes, invitations and connector alerts	United States

2What is not on the list

No analytics, advertising or session-recording provider. There is no such dependency in the application at all.
No error-reporting service. Errors go to the hosting provider's logs and nowhere else.
No font or asset CDN. Web fonts are downloaded at build time and served from Vega's own origin, so loading a Vega page sends no request to a font host.
No payment processor. Vega takes no payments and holds no card data.
No CRM, support desk or marketing tool holding customer content.
No embedding provider. Search vectors are computed by a model that runs inside Vega's own servers and sends no customer text anywhere. Its weights — about 23 MB — are downloaded once from a public model host; that download carries no customer data and happens whether or not anyone has ever used Vega. Until 19 August 2026 embeddings were computed by OpenAI; that was the second AI company on this list and it is gone.
Vega's separate training database is not configured in production, so it holds nothing and is not a subprocessor today. If it is ever configured it will appear here first.

3Changes to this list

We will publish a new subprocessor on this page at least 30 days before it starts processing customer data, and email account holders when we do. If you have a reasonable data-protection objection, tell us within those 30 days at help@tryvega.tech; if we cannot resolve it, you can export what we can produce and close your account.

Every change is recorded in section 5 with a date, so this page's history is readable rather than implied.

4The AI providers, in detail

This is the section a security reviewer asks about, so it carries more than a table row. The statements attributed to each provider are that provider's own published claims, with the date Vega read them; they are not Vega's measurements, and Vega has no way to verify them.

Vega has no zero-retention arrangement with Anthropic. Zero retention is not self-serve there — it requires a sales conversation and approval — and Vega has not obtained it. Content is sent under Anthropic's standard commercial API terms.

Anthropic — what Vega sends at capture, and which models: The topical filter (first 1,800 characters of every capture, before storage), the classifier, the capsule writer, the anonymiser, interest tagging, semantic leak detection, and a daily job that sends a decrypted verbatim transcript of a session. Models used: claude-haiku-4-5 and claude-sonnet-4-6.
Anthropic — what Vega sends at query time: Every answer Vega gives you about your own work is phrased by claude-sonnet-4-6. The request carries your retrieved work moments (title, context, work type, signals), the titles of your open threads, and — where you have opted into keeping verbatim text — decrypted excerpts of your own prompts and the model's replies, capped at 600 characters per transcript turn and shorter for a cited moment. The request is scoped to your own seat, so no other person's content can enter it, and the answer returns only to you. The coaching surface works the same way.
Anthropic — their published position: Anthropic's commercial terms state that "Anthropic may not train models on Customer Content from Services" (anthropic.com/legal/commercial-terms, effective 2025-06-17, read 2026-08-12). Anthropic's privacy centre states that it deletes inputs and outputs "within 30 days of receipt or generation" (privacy.claude.com, read 2026-08-12), and its platform documentation states that retained data "is never used for model training without your express permission" and that zero data retention is requested through their sales team and enabled per organisation (platform.claude.com, read 2026-08-12). Anthropic's own DPA states that in that relationship "Customer is the controller and Anthropic is Customer's processor" — in Vega's case, Vega is that customer, not you.
OpenAI — removed, and what that means for text already sent: Until 19 August 2026 one text per session — the sanitised capsule — went to OpenAI's embeddings endpoint, and until 12 August 2026 the verbatim prompt and reply, up to 8,000 characters, went there too. Both paths are deleted from the code and Vega holds no OpenAI credential. Removing a subprocessor does not un-send what was already sent: text that reached OpenAI before those dates is subject to whatever its standard terms allowed, and Vega cannot recall it. The vectors OpenAI computed have been deleted from Vega's database.

What Vega is doing about it. Two routes were open. The second is done: the OpenAI leg is deleted and embeddings now run on a model inside Vega's own servers, which took one company off this list on 19 August 2026 and is why this page is shorter than it was. The first is not: Vega still has no zero-retention agreement with Anthropic, and obtaining one is a contract rather than a code change. This page will say so until it is signed.

5Change log

Date	Change
2026-08-12	First published. Supabase, AWS, Vercel, Anthropic, OpenAI and Resend listed. No prior list existed, so no additions or removals are recorded — this is the starting state, not a claim that nothing changed before it.
2026-08-19	OpenAI OpCo, LLC removed. It received one text per session — the sanitised capsule — to compute a search vector. That code path is deleted and the work now runs on a model inside Vega's own servers, so no text leaves Vega for an embedding at all. Nothing was added in its place. Text sent before this date cannot be recalled; the vectors it produced have been deleted from Vega's database. A subprocessor REMOVAL needs no advance notice under section 3, which governs additions, but it is recorded here because a customer who read this page last week was told something that is no longer true.
2026-08-19	No company added or removed. The Anthropic entry was corrected: it disclosed only what Vega sends at capture, and omitted that Anthropic is also the engine behind every answer Vega gives you about your own work, receiving your retrieved moments and decrypted excerpts of your own turns at the moment you ask. That was true before this date and was not disclosed; it is disclosed now. Section 4 also states plainly what the absence of a zero-retention agreement means for query-time content.