Legal
Subprocessors
Last updated: June 18, 2026
To deliver the Nudgy compliance-auditing service, Nudgy (“Nudgy”) engages the third-party providers listed below (“subprocessors”) to process data on our behalf and under contract. This page is the authoritative, living list referenced by our Privacy Policy and our Data Processing Agreement.
Each subprocessor is engaged under terms that require data-protection, security, and confidentiality obligations no less protective than those we owe to you, and AI processing runs under commercial API agreements — your documents are submitted for processing only and are not used to train any provider's models.
Current subprocessors
- Microsoft (Microsoft Graph)
Purpose
Read-only file access when you add files from Microsoft 365
Data processed
The OneDrive/SharePoint files you select
Location
Your own Microsoft 365 tenant and its region
- Anthropic
Purpose
AI audit analysis under commercial API terms
Data processed
Specification and drawing text submitted for an audit
Location
United States
- Voyage AI
Purpose
Document embeddings for specification retrieval
Data processed
Specification text submitted for indexing
Location
United States
- Supabase
Purpose
Managed PostgreSQL database and file storage
Data processed
Account data, stored specification and drawing PDFs, the spec index, findings, and audit records
Location
United States (AWS US East, N. Virginia)
- Vercel
Purpose
Application hosting and delivery
Data processed
Request metadata and application traffic
Location
United States / global edge network
- Railway
Purpose
Isolated document-processing workers
Data processed
Specification and drawing files read from storage during indexing and audits
Location
United States
- Resend
Purpose
Transactional and authentication email
Data processed
Recipient email address and message content
Location
United States
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft (Microsoft Graph) | Read-only file access when you add files from Microsoft 365 | The OneDrive/SharePoint files you select | Your own Microsoft 365 tenant and its region |
| Anthropic | AI audit analysis under commercial API terms | Specification and drawing text submitted for an audit | United States |
| Voyage AI | Document embeddings for specification retrieval | Specification text submitted for indexing | United States |
| Supabase | Managed PostgreSQL database and file storage | Account data, stored specification and drawing PDFs, the spec index, findings, and audit records | United States (AWS US East, N. Virginia) |
| Vercel | Application hosting and delivery | Request metadata and application traffic | United States / global edge network |
| Railway | Isolated document-processing workers | Specification and drawing files read from storage during indexing and audits | United States |
| Resend | Transactional and authentication email | Recipient email address and message content | United States |
Some subprocessors process data on servers located outside your country of residence. Where we transfer personal information across borders, we rely on the safeguards described in our Privacy Policy and DPA, including contractual protections and, where applicable, the Standard Contractual Clauses.
Microsoft 365 access is read-only
Microsoft Graph access is read-only, and Nudgy retrieves only the files you explicitly select. Your source files remain in your own Microsoft 365 tenant, in the region your organization has configured; the copy you add to a project is stored by Nudgy as part of that project's audit trail, as described in the Privacy Policy.
Notice of changes
As the Service evolves we may add or replace subprocessors. When we do, we will update this page and the “Last updated” date above before a new subprocessor begins processing personal information, so that this page always reflects our current providers.
To be notified by email of changes to this list, or to exercise any right to object to a new subprocessor available to you under the DPA, email contact@nudgy.ca.