Last updated: April 2026
Parvl Pty Ltd (ACN 696 851 822, ABN 18 696 851 822)
Parvl uses the following third-party sub-processors to deliver our service. We maintain data processing agreements with each sub-processor that require equivalent data protection standards. We will provide at least 30 days' notice before adding or replacing a sub-processor, as described in our Data Processing Agreement.
| Sub-Processor | Purpose | Data Processed | Location | Compliance |
|---|---|---|---|---|
| Anthropic | AI decision classification, confidence scoring, and natural language query processing | Decision text, surrounding context, and query text | San Francisco, USA | SOC 2 Type II |
| OpenAI | Text embeddings (text-embedding-3-small) for semantic search | Decision text for vector embedding generation | San Francisco, USA | SOC 2 Type II |
| Clerk | Authentication, session management, and user identity | Email address, name, profile picture, organization membership | San Francisco, USA | SOC 2 Type II |
| Supabase | Managed PostgreSQL database hosting with pgvector extension | All application data at rest (decisions, source events, user metadata, embeddings) | India (ap-south-1, Mumbai) | SOC 2 Type II |
| Railway | API server hosting, Redis queue and cache (transient data) | Application requests in transit, Redis queue messages (transient) | San Francisco, USA | SOC 2 Type II |
| Vercel | Frontend hosting and static asset delivery | Browser requests, page content served to users | San Francisco, USA | SOC 2 Type II, ISO 27001 |
| Stripe | Payment processing and subscription billing (when billing is enabled) | Billing email, payment method details, invoice history (when billing is enabled) | San Francisco, USA | PCI DSS Level 1, SOC 2 Type II |
| Sentry | Error tracking and application performance monitoring | Error stack traces, request metadata, user ID (no message content) | San Francisco, USA | SOC 2 Type II |
| PostHog | Product analytics, session recording, and usage tracking | Page views, feature usage patterns, session recordings (with text masking), user email and name for identification | United States (US Cloud) | SOC 2 Type II |
We notify all organization administrators by email at least 30 days before adding or changing a sub-processor. You may object to a new sub-processor within 14 days of notification, as described in our Data Processing Agreement.
For questions about our sub-processors, contact privacy@parvl.com.