Subprocessors and service providers

The third parties that handle data to deliver COHESORA, as actually configured today.

Draft — not in force. Draft 0.1 · Not in force — no effective date has been set · Awaiting review by a qualified lawyer (UK data-protection and commercial law).

Providers

Supabase — managed PostgreSQL database (free plan; project region: Paris, eu-west-3 on AWS). Holds all application records. The free plan has no managed backups.
A computer operated by INVICTT AI — runs the API, the background worker and OCR; stores uploaded documents and exports on local disk (pilot arrangement). Location of the machine and physical security are operational facts INVICTT AI must confirm.
Netlify — hosts the web pages and proxies browser requests to the API; request metadata and proxied traffic pass through its network (United States-based provider).
Cloudflare — carries API traffic between Netlify and the computer through a Cloudflare tunnel; traffic is encrypted to Cloudflare's edge where it is processed for delivery.
Resend — sends transactional email (verification, password reset, invitations, trial notices) from the invictt.com domain; receives recipient addresses and message content.
Xero — only if a firm connects it; read-only access under the firm's own authorisation.

Not used

No advertising network, analytics service or payment processor is used by COHESORA today. INVICTT AI does not use any AI/language-model service on firms' data.

AI providers chosen by a firm (optional, off by default)

A firm administrator may connect the firm's OWN account with an AI provider (OpenAI, Anthropic or an OpenAI-compatible endpoint) to draft client summaries and request wording. Only then, and only for the record a user asks about, COHESORA sends that provider a short fact summary (titles, statuses, dates, counts) — never document contents, messages, e-mail addresses or phone numbers. The firm contracts with that provider directly; it is the firm's processor, not an INVICTT AI subprocessor. Firebase Cloud Messaging (Google) delivers optional browser notifications containing no client details.

Decisions required before this can take effect

Matters for professional legal approval or for INVICTT AI to determine. They are deliberately not answered here.

Confirm each provider's contractual terms, regions and DPAs; add each provider's legal entity.
Confirm where the INVICTT AI computer is located and who has administrative access.
Decide how customers are notified of subprocessor changes.