1. Current sub-processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Lovable Cloud (infrastructure provided via Supabase, Inc.) | Database, file storage, sign-in and server functions | All account details and all customer project content | AWS eu-west-1 (Ireland, EU) |
| Lovable (app hosting, Lovable Labs Incorporated) | Serving the website and app, running server code | Requests passing through, including project content in transit | Global — pages are served from locations near each visitor |
| Anthropic PBC (Claude) | Answers, document and drawing reading, RAMS and contract drafting | Questions and relevant project passages/pages | USA (data at rest). Requests can be processed in other regions under Anthropic's standard routing |
| OpenAI, L.L.C. | Search embeddings, live voice, and fallback for answers when Anthropic is unavailable | Document text for indexing, questions, live voice audio | USA (OpenAI's standard API region) |
| Voyage AI, a MongoDB, Inc. company | Re-ranking search results | Questions and candidate project passages. Data collection for model training is switched off. | EU (MongoDB Atlas, EU geography) |
| Resend (Plus Five Five, Inc.) | Enquiry, account and project notification emails | Recipient name and email address, enquiry details, and the project and RAMS details shown in notifications | Emails sent from AWS eu-west-1 (Ireland, EU); Resend's main operations are in the USA |
2. AI training
Civvio doesn't use your data to train AI models, and neither do our AI providers. Anthropic and OpenAI are used through their paid business APIs, whose terms don't allow training on customer content (Anthropic commercial terms, OpenAI business terms). Voyage AI's data collection for training is switched off on our account. Providers may hold data briefly for abuse monitoring before deleting it.
3. Changes
We will update this page and notify customers before adding a new sub-processor, as set out in the Data Processing Addendum.