Customer contracts control the final list
A customer order form, DPA, private-data-lane addendum, or security exhibit can narrow providers, regions, retention, or optional services for that customer.
Trust and legal
Subprocessors and service providers
This inventory identifies third-party providers AbarVa may use to provide, secure, operate, bill, support, or measure the product. Customer agreements control the final committed provider set for a given engagement.
Last updated 2026-06-02
| Provider | Role | Data categories | Status | Safeguards |
|---|---|---|---|---|
| Microsoft Azure | Client data-plane infrastructure, object storage, databases, private networking, secrets, observability, and optional Azure AI services. | Customer-scoped records, evidence files, processing logs, operational telemetry, and secrets where the customer lane is configured for Azure. | Active | Tenant-scoped adapters, private data-plane architecture, encryption controls inherited from Azure services, and customer-owned Azure subscription option for private lanes. |
| Vercel | Shared SaaS control-plane hosting, previews, production deployment, edge routing, and platform runtime logs. | Application requests, routing metadata, build metadata, static assets, and limited operational logs. Client-private payload persistence must route through data-plane adapters. | Active | Control-plane/data-plane separation, immutable deployments, HTTPS, release previews, and rollback through prior deployment promotion or revert PR. |
| Clerk | Authentication, session management, organization membership, MFA, and user identity metadata. | User account identifiers, email addresses, session metadata, organization membership, role claims, and authentication events. | Active | Route-level auth gates, short-lived sessions, role checks, organization scoping, and tenant access validation before client data is served. |
| Anthropic | Large language model inference for broker-mediated reasoning and drafting workflows. | Prompt excerpts, user instructions, retrieved context, generated text, and AI usage metadata when the model path is enabled. | Optional | AgentContextBroker mediation, tenant binding, prompt minimization, human-decision controls, and no final-decision authority. |
| OpenAI | Large language model inference, embeddings, and related AI capability where enabled for a client or product path. | Prompt excerpts, retrieved context, embeddings inputs, generated text, and AI usage metadata when the provider path is enabled. | Optional | Provider routing through governed model paths, prompt minimization, human-decision controls, and opt-out or provider-specific configuration where contracted. |
| Resend | Transactional email delivery for product and operational notifications. | Recipient email address, message metadata, template payloads, delivery events, bounces, and complaints. | Optional | Webhook signature verification, scoped notification dispatch, and use limited to notification flows when configured. |
| Stripe | Billing and payment operations where commercial checkout or subscription billing is enabled. | Billing contact information, customer billing identifiers, invoice metadata, payment status, and subscription metadata. | Optional | Billing-only integration boundary and feature-path configuration; pilot or enterprise contracts may use offline billing instead. |
| PostHog | Product analytics, usage measurement, feature observability, and pilot success telemetry where enabled. | Usage events, page or feature interactions, client/user identifiers where configured, and aggregated analytics metadata. | Optional | Feature-specific instrumentation, analytics minimization, and customer-specific disablement where required by contract. |
| Supabase | Compatibility-era Postgres, auth/RLS test residue, migrations, or deprecation evidence. | Legacy or test-path records only where an existing compatibility path remains in scope. | Legacy compatibility | New runtime data-backed work must use Azure/Postgres data-plane adapters rather than adding direct Supabase dependencies. |
| Pinecone | Compatibility-era vector retrieval or historical tenant namespace references. | Legacy vector metadata or embeddings where an existing compatibility path remains in scope. | Legacy compatibility | New runtime retrieval work should follow governed broker and data-plane adapter boundaries unless separately contracted. |
| Neo4j | Compatibility-era graph references, tests, migrations, or optional historical graph experiments. | Legacy graph metadata where an existing compatibility path remains in scope. | Legacy compatibility | No new runtime graph dependency should be introduced without a separate architectural decision and contract review. |
Use status distinguishes default infrastructure from optional product paths and compatibility-era providers. Optional and legacy entries should be read with the customer contract, security exhibit, or private data-plane addendum for the applicable engagement.
Optional services can be disabled
Email, analytics, billing, and model-provider paths are configured by product path and contract posture. They are not a blanket requirement for every pilot.
Legacy names are not new dependencies
Supabase, Pinecone, and Neo4j may still appear in compatibility shims, tests, migrations, or deprecation docs, but new runtime work follows Azure/Postgres and governed broker boundaries.