Overview
This page lists all third-party sub-processors that Cove (operated by Версей ЕООД / Versey EOOD, UIC 208443341) uses to process personal data on behalf of our customers. This list is maintained in accordance with Article 28 of the GDPR and our Data Processing Agreement.
We will update this page when sub-processors are added or changed. If you are a customer with a Data Processing Agreement, you will receive at least 30 days' advance notice of any changes to this list.
Infrastructure and Hosting
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| Supabase, Inc. | Database hosting, user authentication, and the functions that send notification emails | United States | United States (AWS us-east-1) |
| Vercel, Inc. | Application hosting, edge compute, and serverless functions | United States | US / EU (edge network) |
| DigitalOcean, LLC | Storage of uploaded and generated files (DigitalOcean Spaces) | United States | EU (Frankfurt) |
AI and Document Processing
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| Anthropic, PBC | AI-powered document extraction, classification, and data analysis via Claude API (the default language model provider) | United States | United States |
| OpenAI Ireland Ltd. | Language models for document extraction, classification, the Cove agent and dictation (an alternative or automatic fallback provider, depending on configuration) | Ireland (EU) | United States |
| Google LLC (Gemini API) | Language models for document extraction, classification, the Cove agent and dictation (an alternative or automatic fallback provider, depending on configuration) | United States | United States |
Communications
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| Resend, Inc. | Transactional email delivery (invoice emails, verification codes, reminders) | United States | United States |
Payments and Banking
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| Polar Software, Inc. | Payment processing for Cove subscriptions, as the merchant of record | United States | United States |
| Iris Solutions | Account information and payment initiation under PSD2 when a customer connects a bank account (a payment institution licensed by the Bulgarian National Bank) | Bulgaria (EU) | EU |
Inbound Email
Cove does not connect to any mailbox you own. Each organization is issued its own Cove address and you forward documents to it; this sub-processor receives that mail and holds it briefly so it can be processed.
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Receiving forwarded email and storing the raw message for up to 30 days | Luxembourg (EU) | EU (Frankfurt) |
Analytics and Consent
On our website (joincove.io), analytics starts only for visitors who accept the "Statistics" category in our cookie banner; see our Cookie Policy. In the application (app.joincove.io), product analytics and the application's technical logs are sent to PostHog as part of providing and securing the Service, on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), and are linked to the user's ID and email address.
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| PostHog, Inc. | Product analytics, session replay, error and performance diagnostics, and the application's technical logs (EU Cloud) | United States | EU (Germany) |
| Usercentrics A/S (Cookiebot) | Cookie consent banner on our website and consent record keeping | Denmark (EU) | EU |
Other Services
| Sub-processor | Purpose | Entity Location | Data Processing Location |
|---|---|---|---|
| VATStack | VAT rates by country: it receives only a country code (and, when the request comes from the browser, its IP address) and returns that country's VAT rates. VAT numbers are not validated through VATStack but checked directly against VIES, HMRC and national business registers, which receive only the number checked | EU | EU |
| CompanyBook (companybook.bg) | Bulgarian company data lookups; it receives only the company or VAT number searched for | Bulgaria (EU) | EU |
| GitHub, Inc. (GitHub Pages) | Serves the country flag images the browser loads; it receives only the visitor's IP address | United States | United States |
| Google LLC (Google Fonts) | Serves the fonts the browser loads for invoice and document designs; it receives only the visitor's IP address | United States | United States |
| CartoDB Inc. (CARTO) | Serves the map tiles the browser loads for maps in the application; it receives only the visitor's IP address | United States | United States |
| randomuser.me | Serves the demonstration photos the browser loads in the application's welcome tour; it receives only the visitor's IP address | Not published | Not published |
Data Transfer Safeguards
For sub-processors located outside the European Economic Area, we rely on the following transfer mechanisms:
- EU-US Data Privacy Framework (DPF): Applicable to Vercel, which is certified under the DPF
- Standard Contractual Clauses (SCCs): Applicable to Supabase, Anthropic, Resend, and PostHog, in accordance with Commission Implementing Decision (EU) 2021/914
- SCCs or the EU-US Data Privacy Framework, as provided by each recipient: Applicable to DigitalOcean, Google, Polar, GitHub, and CARTO
- OpenAI: Our contracting party is OpenAI Ireland Ltd., which transfers data to OpenAI affiliates outside the EEA under SCCs
- No transfer required: Amazon Web Services processes inbound email entirely within the EEA (Frankfurt); Iris Solutions and CompanyBook are established in the EU (Bulgaria)
- Transfer Impact Assessments (TIAs): Conducted for all transfers to non-EEA jurisdictions to evaluate and ensure adequate protection
Changes to This List
Last updated: October 4, 2026
To receive notifications about changes to our sub-processor list, contact us at filip@joincove.io.
Contact
If you have questions about our sub-processors or data transfers:
- Email: filip@joincove.io