Subprocessor List

The providers below process personal data on DuruVault's behalf to deliver specific functionality. This list reflects verified providers in use or configured as of the effective date. It may change as the Services evolve; DuruVault will update it where required and, where legally required, provide a mechanism to object to changes.

Current & configured subprocessors

Status key: Live = in production use; Configured = integrated and gated, not yet activated for live subscribers; DR = disaster-recovery archive only.

• Provider

  Emergent (platform)
  Service / purpose

  Application hosting, managed MongoDB (Atlas), managed email (Resend), managed AI gateway
  Data processed

  Account data, document metadata, content submitted to AI features, email address & message content
  Region

  Provider-managed / US where applicable
  Status

  Live
• Provider

  Stripe
  Service / purpose

  Card payments, subscriptions, and Stripe Identity verification
  Data processed

  Billing and payment status, subscription state, identity-verification data you submit (DuruVault does not store full card numbers)
  Region

  Provider-managed / US & global
  Status

  Live (payments); Identity as configured
• Provider

  Paystack
  Service / purpose

  Payments for supported African regions
  Data processed

  Billing and payment status for African-region checkouts
  Region

  Provider-managed / Africa & global
  Status

  Configured (production activation gated)
• Provider

  Dojah
  Service / purpose

  Identity / document / liveness verification
  Data processed

  Identity data you submit to a verification check
  Region

  Provider-managed
  Status

  Configured (sandbox)
• Provider

  Tigris (object storage)
  Service / purpose

  Primary document & file storage
  Data processed

  Documents and files you upload
  Region

  Provider-managed / US where applicable
  Status

  Live
• Provider

  Backblaze B2
  Service / purpose

  Independent encrypted off-site backup / disaster recovery
  Data processed

  Encrypted database and object backups (not decryptable by B2)
  Region

  Provider-managed / US
  Status

  DR
• Provider

  Resend (via Emergent)
  Service / purpose

  Transactional email
  Data processed

  Email address and message content
  Region

  Provider-managed / US where applicable
  Status

  Live
• Provider

  Emergent-managed AI (OpenAI / Anthropic / Google)
  Service / purpose

  OCR, extraction, classification, search, assistant
  Data processed

  Content and prompts you submit to AI features
  Region

  Provider-managed / US where applicable
  Status

  Live

Notes

Providers process information under their own agreements and technical configurations. DuruVault does not represent that any provider holds a specific certification unless expressly confirmed. Payment-card data is handled by PCI-DSS-validated payment processors; DuruVault does not intentionally store complete card numbers.