Subprocessors
Last updated: June 21, 2026
This page lists the third-party subprocessors that SACS Ecommerce Stores Inc. (operating as "Cohvia") engages to help provide the Cohvia platform (the "Service"). It is incorporated by reference into our Data Processing Agreement (the "DPA") and supports our Privacy Policy.
A subprocessor is a third party we authorize to process Customer Data on our behalf in order to deliver the Service. Each subprocessor is bound by a written agreement that limits its use of Customer Data to providing services to us and requires data-protection obligations no less protective than those in our DPA.
1. How we manage subprocessors
- We perform diligence on each subprocessor's security and privacy practices before engaging it.
- We sign a data processing agreement (with EU/UK Standard Contractual Clauses where required) with each subprocessor that processes personal data.
- We route AI processing only to providers that are contractually committed not to train on submitted data and, where available, to operate under zero-data-retention terms.
- We remain responsible to you for each subprocessor's performance.
2. Notice of changes
As described in Section 6.2 of the DPA, we give customers at least 30 days' notice before adding or replacing a subprocessor that processes Customer Data. Customers may object on reasonable data-protection grounds within the notice period, as set out in the DPA. To receive these notifications, contact privacy@cohvia.com.
3. Current subprocessors
3.1 Infrastructure subprocessors
These providers host and run the core platform and process Customer Data as part of delivering the Service.
| Subprocessor | Purpose / processing activity | Primary processing location |
|---|---|---|
| Vercel Inc. | Application hosting, content delivery, edge/routing | United States |
| Supabase, Inc. | Primary database, file storage, and vector embeddings storage | United States |
| Clerk, Inc. | User authentication, session, and identity management | United States |
| Nango, Inc. | Third-party data integrations / connectors (CRM, email, ticketing) | United States |
3.2 AI / model-processing subprocessors
These providers process Customer Data to generate Outputs. None of them train their models on Customer Data submitted through the Service.
| Subprocessor | Purpose / processing activity | Primary processing location |
|---|---|---|
| OpenRouter, Inc. | AI model routing/gateway directing requests to model providers | United States |
| Anthropic, PBC | Large language model inference (account narratives, insights, plans) | United States |
3.3 Operational subprocessors
These providers support communications and product operations.
| Subprocessor | Purpose / processing activity | Primary processing location |
|---|---|---|
| Plus Five Five, Inc. (Resend) | Transactional and compliance email delivery | United States |
4. Payment processing (independent controller, not a subprocessor)
Payments are handled by Dodo Payments, which acts as merchant of record and as an independent controller of the payment and buyer data it collects directly from customers. Because Dodo determines its own purposes and means for that payment data, it is not a Cohvia subprocessor, and its handling of that data is governed by Dodo's own privacy policy and terms, not our DPA. We reference it here for transparency.
5. A note on locations and entity details
Processing locations can be region-configurable and may change as our infrastructure evolves; the specific data-center region for some providers depends on configuration. Legal entity names and locations above should be confirmed against each provider's current DPA before you rely on this page externally. The categories and purposes are the substantive commitments; specific vendors within a category may change on notice per Section 2.
Contact: SACS Ecommerce Stores Inc. (operating as Cohvia), 620 King Street North, Suite 1004, Waterloo, Ontario N2J 4G8, Canada — privacy@cohvia.com.