Legal
Subprocessors
Last updated: June 18, 2026
To deliver the Nudgy compliance-auditing service, Nudgy (“Nudgy”) engages the third-party providers listed below (“subprocessors”) to process data on our behalf and under contract. This page is the authoritative, living list referenced by our Privacy Policy and our Data Processing Agreement.
Each subprocessor is engaged under terms that require data-protection, security, and confidentiality obligations no less protective than those we owe to you, and AI processing runs under commercial API agreements — your documents are submitted for processing only and are not used to trainany provider's models.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft (Microsoft Graph) | Read-only file access when you add files from Microsoft 365 | The OneDrive/SharePoint files you select | Your own Microsoft 365 tenant and its region |
| Anthropic | AI audit analysis under commercial API terms | Specification and drawing text submitted for an audit | United States |
| Voyage AI | Document embeddings for specification retrieval | Specification text submitted for indexing | United States |
| Supabase | Managed PostgreSQL database and file storage | Account data, stored specification and drawing PDFs, the spec index, findings, and audit records | United States (AWS US East, N. Virginia) |
| Vercel | Application hosting and delivery | Request metadata and application traffic | United States / global edge network |
| Railway | Isolated document-processing workers | Specification and drawing files read from storage during indexing and audits | United States |
| Resend | Transactional and authentication email | Recipient email address and message content | United States |
Some subprocessors process data on servers located outside your country of residence. Where we transfer personal information across borders, we rely on the safeguards described in our Privacy Policy and DPA, including contractual protections and, where applicable, the Standard Contractual Clauses.
Microsoft 365 access is read-only
Microsoft Graph access is read-only, and Nudgy retrieves only the files you explicitly select. Your source files remain in your own Microsoft 365 tenant, in the region your organization has configured; the copy you add to a project is stored by Nudgy as part of that project's audit trail, as described in the Privacy Policy.
Notice of changes
As the Service evolves we may add or replace subprocessors. When we do, we will update this page and the “Last updated” date above before a new subprocessor begins processing personal information, so that this page always reflects our current providers.
To be notified by email of changes to this list, or to exercise any right to object to a new subprocessor available to you under the DPA, email contact@nudgy.ca.