Valuesync AS
Valuesync uses the sub-processors below to deliver the platform. Each has entered into a data processing agreement with Valuesync imposing data protection obligations equivalent to those in our Data Processing Agreement, and Valuesync remains fully liable for their performance.
Customer Data, meaning the database, document storage and authentication, is stored in the EU, and the application runs in an EU region. Agent runs and document analysis are processed in the EU. Chat, classification and failover may be processed in the United States, and content from an uploaded document may be included in such a request.
| Provider | Service | Data processed | Processing location | Transfer basis |
|---|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, file storage and authentication | All categories of Customer Data | EU (Frankfurt, Germany) | Data is stored in the EU. Our contracting entity is established in Singapore, and the transfer is covered by a data processing agreement incorporating the EU Standard Contractual Clauses |
| Vercel Inc. (Delaware, USA) | Application hosting and execution | Data in process during the session | EU | The application runs in an EU region. Our contracting entity is established in the United States and is certified under the EU-U.S. Data Privacy Framework, supported by a data processing agreement incorporating the EU Standard Contractual Clauses |
| Microsoft Ireland Operations Limited (Ireland) | Azure OpenAI, primary model provider for agent runs and document analysis | Content submitted for analysis, including uploaded documents | EU Data Zone deployment, all processing within the EU | Contracting entity and processing are both within the EEA |
| OpenAI Ireland Ltd (Ireland) | Model provider for chat, classification and failover | Prompts and content submitted for these functions, which may include all or part of an uploaded document | United States | Contracting entity is within the EEA. Processing takes place in the United States under OpenAI's data processing agreement incorporating the EU Standard Contractual Clauses. Data is not used for model training. Retained for up to 30 days for abuse monitoring, then deleted |
| Google Cloud EMEA Limited (Ireland) | Reserve model provider, used only if another provider is unavailable | Content submitted for analysis | United States | Contracting entity is within the EEA. Onward transfer is made to Google LLC, which is certified under the EU-U.S. Data Privacy Framework, supported by the EU Standard Contractual Clauses. Data is not used for model training. Retained for up to 55 days for abuse monitoring, then deleted |
| Functional Software, Inc. d/b/a Sentry (USA) | Application error monitoring | Technical error data and user ID. No document content | European Union | Processing takes place in the EU. Our contracting entity is established in the United States and is certified under the EU-U.S. Data Privacy Framework, supported by a data processing agreement incorporating the EU Standard Contractual Clauses |
| Plus Five Five, Inc. d/b/a Resend (USA) | Transactional email and notifications | Name, email address, message content | Ireland (eu-west-1) | Processing takes place in the EU. Our contracting entity is established in the United States and is certified under the EU-U.S. Data Privacy Framework, supported by a data processing agreement incorporating the EU Standard Contractual Clauses |
External data sources
The platform retrieves publicly available company information from external sources, including Creditsafe, Proff and Bolagsverket.
Valuesync transmits only a company name or organisation number in order to serve the request. These sources are not sub-processors, receive no documents or platform content, and are not told which customer a lookup relates to. Information retrieved from them becomes part of the Customer's own Customer Data and is subject to our Data Processing Agreement in the same way as any other content in the platform.
AI analysis. Valuesync routes requests between model providers depending on the task. Agent runs and document analysis are processed on Azure OpenAI within the EU. Chat, classification and failover may be processed in the United States, and content from an uploaded document may be included in such a request. Content submitted to any model provider is processed solely in order to generate the individual response and is not used to train or improve AI models. Retention for abuse monitoring is stated per provider in the table above. See section 10 of the Data Processing Agreement.
Changes. We give customers reasonable advance notice before engaging a new sub-processor or replacing an existing one, by email to the registered contact and by updating this page. Customers may object on reasonable data protection grounds. See section 8 of the Data Processing Agreement.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 6 August 2026 | First published version |