Help CentreVeridox engages the third-party sub-processors listed below to process personal data on behalf of our customers, in accordance with Section 8 (Use of Sub-Processors) of our Data Processing Addendum. We remain responsible for our sub-processors' compliance with the obligations in the DPA.
We keep this page current. We notify customers of new or changed sub-processors at least 20 days in advance; to object, or to subscribe to change notifications, contact [dpo@veridox.ai].
A note on data minimisation: Our document-verification checks send each provider only the single identifier being verified (for example, a VAT number or a registration plate) — never the uploaded document, image, or any wider record.
Infrastructure & hosting
| Sub-processor | Purpose | Personal data processed | Processing location |
|---|---|---|---|
| Amazon | Application hosting, primary database, search index, logging | Account & case data, document metadata, analysis results, emails | UK (London) or Canada, per your account region |
| Microsoft | Document storage and enrichment artifacts | Uploaded case files, OCR output, generated reports | UK or Canada, per your account region |
| Hosts the AI models used for document analysis | Full document content, extracted text and entities | Global |
AI, analysis & search
| Sub-processor | Purpose | Personal data processed | Processing location |
|---|---|---|---|
| Primary document analysis, summarisation, chat assistant, search | Document content, OCR text, extracted entities, analysis context | Global | |
| Perplexity, Inc. | Web-search corroboration of entities and claims in documents | Natural-language questions derived from document content (business/place names and similar claims) | United States |
| Microsoft | Optical character recognition and barcode extraction | Full uploaded file content | UK (London) or Canada, per your account region |
| Idée, Inc | Reverse image search | The uploaded image | United States |
Document verification (identifier checks)
Each check sends only the single identifier shown.
| Sub-processor | Purpose | Personal data processed | Processing location |
|---|---|---|---|
| Vehicle Data Global Limited | UK vehicle registration verification (licensed DVLA data) | A vehicle registration plate | United Kingdom |
| SmartyStreets, LLC | Postal address verification | A postal address | United States |
| IDDQD Limited | UK postcode verification | A postcode | United Kingdom |
| Gatemill, Inc | VAT number verification | A VAT registration number | United States |
| VIES (European Commission) | EU VAT number verification | A VAT registration number | European Union |
| NHTSA vPIC (US Dept. of Transportation) | Vehicle VIN decoding | A vehicle identification number (VIN) | United States |
| FlightAware, LLC | Flight-status verification | A flight number and travel date | United States |
| AeroDataBox | Flight-status verification (fallback) | A flight number and travel date | United States |
Verification against public company registries — Companies House (UK) and GLEIF (global LEI) — sends only a company registration number, which is not personal data. Listed for completeness.
Analytics & communications
| Sub-processor | Purpose | Personal data processed | Processing location |
|---|---|---|---|
| PostHog | Product analytics, feature flags, error monitoring | User and organisation identifiers, usage events, error reports (no document content) | European Union |
| SendGrid | Transactional email and account notifications | Recipient name and email address, security codes, account links | United States |
Changes to this list
In line with Section 8 of the DPA, Veridox will give 20 days notice of any new or replaced sub-processor. Customers may object on reasonable data-protection grounds by contacting dpo@veridox.ai within the notice period.