Sub-processors
Effective 30 August 2026 · Operated by [Your name], an independent developer based in Hyderabad, India
nvault engages the third parties below to help deliver the service. Each is bound by contractual security and confidentiality obligations. None receives plaintext file contents or your vault passphrase — file data crosses these systems only as ciphertext.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, and scheduled jobs | Encrypted request/response traffic, minimal operational logs (no secret values) | United States (global edge) |
| Managed Postgres provider (e.g. Neon or Supabase) | Primary database — stores encrypted file blobs, wrapped keys and account metadata | Ciphertext file versions, wrapped encryption keys, account and organization metadata, audit records | Configured per deployment; choose a region close to your users |
| Polar Software Inc. (Polar) | Merchant of Record — checkout, subscription billing, invoicing and tax | Name, email, billing address, payment card data (held by Polar, never by nvault), subscription records | United States / European Union |
Changes and notice
We keep this list current. Organizations on the Team plan can request advance email notice of new sub-processors by writing to privacy@nvault.dev; we will give at least 30 days' notice before a new sub-processor starts processing personal data, during which you may raise a reasonable objection.
Onward transfers
Where a sub-processor is outside India, the EU or the UK, transfers are covered by that provider's contractual safeguards (including Standard Contractual Clauses where applicable). See the Privacy Policy and Data Processing Addendum for details.